<html><body><div><div>Thank you very much for your help it works like a charm now :)<br></div><div>Time for me to educate myself about that kind of topic.<br></div><div>Have a very nice day Yorgos !<br></div><div><br></div><div>Alexandre</div><div><br></div><blockquote type="cite"><div>Le 1 août 2024 à 14:26, Yorgos Thessalonikefs <yorgos@nlnetlabs.nl> a écrit :<br></div><div><br></div><div><br></div><div><div><div>The first file enables remote control while the second configures the <br></div><div>trust anchor.<br></div><div>You can put your custom configuration file in this directory as well.<br></div><div>Without any include directives though.<br></div><div>So from your first email the contents of that file should only be:<br></div><div>```<br></div><div>server:<br></div><div> # send minimal amount of information to upstream servers to enhance <br></div><div>privacy<br></div><div> qname-minimisation: yes<br></div><div> # the interface that is used to connect to the network (this will <br></div><div>listen to all interfaces)<br></div><div> interface: 0.0.0.0<br></div><div> # interface: ::0<br></div><div> # addresses from the IP range that are allowed to connect to the <br></div><div>resolver<br></div><div> access-control: 192.168.1.0/26 allow<br></div><div> # access-control: 2001:DB8/64 allow<br></div><div>```<br></div><div><br></div><div>And the /etc/unbound/unbound.conf file should be left at the default:<br></div><div>```<br></div><div>include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"<br></div><div>```<br></div><div><br></div><div>Best regards,<br></div><div>-- Yorgos<br></div><div><br></div><div>On 01/08/2024 14:13, Alexandre Froissard wrote:<br></div><blockquote type="cite"><div>I just check and in the /etc/unbound/unbound.conf.d/ directory, I found <br></div><div>2 files :<br></div><div><br></div><div>afroissard@<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">raspberrypi:/etc/unbound/unbound.conf.d</a> <br></div><div><<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">http://raspberrypi:/etc/unbound/unbound.conf.d</a>>$ ls -al<br></div><div>total 16<br></div><div>drwxr-xr-x 2 root root 4096 Jul 31 18:30 .<br></div><div>drwxr-xr-x 3 root root 4096 Aug 1 11:25 ..<br></div><div>-rw-r--r-- 1 root root 195 Feb 26 13:47 remote-control.conf<br></div><div>-rw-r--r-- 1 root root 190 Feb 26 13:47 root-auto-trust-anchor-file.conf<br></div><div>afroissard@<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">raspberrypi:/etc/unbound/unbound.conf.d</a> <br></div><div><<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">http://raspberrypi:/etc/unbound/unbound.conf.d</a>>$<br></div><div><br></div><div>When I cat them here's what's inside :<br></div><div><br></div><div>afroissard@<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">raspberrypi:/etc/unbound/unbound.conf.d</a> <br></div><div><<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">http://raspberrypi:/etc/unbound/unbound.conf.d</a>>$ cat <br></div><div>root-auto-trust-anchor-file.conf<br></div><div>server:<br></div><div> # The following line will configure unbound to perform cryptographic<br></div><div> # DNSSEC validation using the root trust anchor.<br></div><div> auto-trust-anchor-file: "/var/lib/unbound/root.key"<br></div><div>afroissard@<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">raspberrypi:/etc/unbound/unbound.conf.d</a> <br></div><div><<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">http://raspberrypi:/etc/unbound/unbound.conf.d</a>>$ cat remote-control.conf<br></div><div>remote-control:<br></div><div> control-enable: yes<br></div><div> # by default the control interface is is 127.0.0.1 and ::1 and port 8953<br></div><div> # it is possible to use a unix socket too<br></div><div> control-interface: /run/unbound.ctl<br></div><div>afroissard@<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">raspberrypi:/etc/unbound/unbound.conf.d</a> <br></div><div><<a href="http://raspberrypi:/etc/unbound/unbound.conf.d" rel="noopener noreferrer">http://raspberrypi:/etc/unbound/unbound.conf.d</a>>$<br></div><div><br></div><div><br></div><blockquote type="cite"><div>Le 1 août 2024 à 12:13, Yorgos Thessalonikefs <yorgos@nlnetlabs.nl> a <br></div><div>écrit :<br></div><div><br></div><div><br></div><div><br></div><div>On 01/08/2024 11:48, Alexandre Froissard wrote:<br></div><blockquote type="cite"><div>I commented # the auto-trust-anchor-file from my configuration file ans<br></div><div>it works just fine now.<br></div><div>I'm not a Linux specialist.<br></div><div>From what I understand, removing this line will tell Ubuntu to use what<br></div><div>was installed by default, correct ?<br></div><div>I'm trying to make sure removing this line has no consequences on the<br></div><div>security of the system and/or dns service.<br></div></blockquote><div>Removing this line does not explicitly tell anything to Unbound.<br></div><div>I believe one of the files under /etc/unbound/unbound.conf.d/ specifies<br></div><div>a trust-anchor and that should be the system installed one.<br></div><div>You can verify yourself by looking at the files under<br></div><div>/etc/unbound/unbound.conf.d/.<br></div><div><br></div><div>Best regards,<br></div><div>-- Yorgos<br></div></blockquote></blockquote></div></div></blockquote></div><div><br></div></body></html>