<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi,<br>
<br>
I would appreciate feedback on how best to go about setting unbound
to handle queries for tor services/domains.<br>
<br>
Running a tor daemon client node as SOCKS5 proxy with
username/password credentials @ 192.168.112.12:9100 (tcp)<br>
<br>
First off my understanding is that < onion. | test. | invalid.
> by unbound's default are resulting in nx and thus would start
off with:<br>
<br>
server:<br>
domain-insecure: onion<br>
local-zone: "onion." static<br>
local-data: "onion. IN A 192.168.112.12"<br>
tls-cert-bundle: "/path/to/tor/cached-certs"<br>
trust-anchor-file: "/path/to/tor/cached-microdesc-consensus"<br>
<br>
Not sure whether/how unbound would interpret the trust-anchor-file
and whether it can be even considered a trust-anchor?<br>
<br>
and then perhaps <br>
<br>
forward-zone:<br>
name: "onion."<br>
forward-addr: 192.168.112.12@9100 <br>
<br>
And there it stops with username/password credentials for the SOCKS5
proxy since I could not find a directive for unbound to parse those.<br>
Would the unbound queries work anyway if the tor node would be
running as SOCKS5 proxy but sans credentials?<br>
<br>
Since tor node is caching < cached-microdescs > I was
wondering whether that could perhaps satisfy auth-zone as opposed to
forwarding (and thus avoiding querying the SOCKS5 proxy?<br>
<br>
auth-zone:<br>
name: "onion."<br>
for-downstream: no<br>
fallback-enabled: no<br>
zonefile: "/path/to/tor/cached-microdescs"<br>
<br>
<br>
</body>
</html>