Skip to content

Operations

This page covers running Unbound DNS Resolver day to day: how it is secured, how it is updated, what to back up, where the logs are, and how to get help.

Security model

  • Loopback only. The resolver and the test-zone server listen on 127.0.0.1, and the resolver refuses every client except 127.0.0.1.
  • Unprivileged service. Both Unbound services run as the unbound user, in a tightly restricted systemd sandbox.
  • Per-instance keys. The test zone's signing keys are generated on first boot and stored in /var/lib/unbound-dnssec/, readable only by root. The ubuntu user cannot read them.
  • SSH. Password authentication and root login are turned off.
  • No AWS access. Unbound does not call AWS APIs and needs no IAM permissions.

Manage the services

sudo systemctl status unbound unbound-auth
sudo systemctl reload unbound
sudo systemctl restart unbound

Both services wait for sushi-unbound-firstboot.service, and restart automatically if they fail. A restart empties the cache. The test zones and local data come back from their files.

Logs

sudo journalctl -u unbound --no-pager -n 100
sudo journalctl -u unbound-auth --no-pager -n 100
sudo journalctl -u sushi-unbound-firstboot --no-pager

Queries and replies are not logged by default.

Updates

  • Ubuntu packages, including OpenSSL, expat and the BIND tools, get security updates automatically through unattended upgrades. They do not replace Unbound.
  • Unbound itself stays at 1.26.1. There is no in-place upgrade. A new Unbound release comes as a new version of the AMI: launch it, copy the files you want to keep, and move clients over.

Backups

The cache lives in memory and is not worth backing up. To keep the same configuration and test-zone keys on a replacement instance, copy these together, over a private channel:

  • /etc/unbound/unbound.conf
  • /etc/unbound/unbound-auth.conf
  • /etc/unbound/unbound.conf.d/
  • /var/lib/unbound/root.key
  • /var/lib/unbound-dnssec/
  • /etc/unbound/zones/secure.test.zone
  • /etc/unbound/secure.test.ds

/var/lib/unbound-dnssec/ holds private keys. The other files are public DNSSEC material, but still keep them out of tickets and chat.

Check the installation

The image includes a self-test that runs as root:

sudo /opt/sushi/bin/smoke.sh

It checks local data, DNSSEC answers, the refused unsigned zone and forwarding on loopback.

Support

Software Sushi provides AMI packaging and setup guidance. Email info@softwaresushi.com with installation questions. Support coverage beyond that requires a separate agreement. This offer does not include support from NLnet Labs or the Unbound project.