|
 |
0c84e1 |
# validate_connection_provided_zones:
|
|
|
0c84e1 |
# -----------------------------------
|
|
|
0c84e1 |
# Setts if forward zones added into unbound by dnssec-trigger script
|
|
|
0c84e1 |
# will be DNSSEC validated or NOT. Note that this setting is global
|
|
|
0c84e1 |
# for all added forward zones..
|
|
|
0c84e1 |
# Possible options are:
|
|
|
0c84e1 |
#
|
|
|
0c84e1 |
# validate_connection_provided_zones=yes - All connection provided zones
|
|
|
0c84e1 |
# configured as forward zones into
|
|
|
0c84e1 |
# unbound WILL BE DNSSEC validated
|
|
|
0c84e1 |
# (NOTE: If connection provided DNS
|
|
|
0c84e1 |
# servers are NOT DNSSEC capable, the
|
|
|
0c84e1 |
# resolving of provided zones will
|
|
|
0c84e1 |
# NOT work!)
|
|
|
0c84e1 |
#
|
|
|
0c84e1 |
# validate_connection_provided_zones=no - All connection provided zones
|
|
|
0c84e1 |
# configured as forward zones into
|
|
|
0c84e1 |
# unbound will NOT be DNSSEC validated
|
|
|
0c84e1 |
#
|
|
|
0c84e1 |
#
|
|
|
0c84e1 |
# NOTICE: if you turn the validation OFF then all forward zones added by
|
|
|
0c84e1 |
# dnssec-trigger script will NOT be DNSSEC validated. If you turn the
|
|
|
0c84e1 |
# validation ON, only newly added forward zones will be DNSSEC validated.
|
|
|
0c84e1 |
# Forward zones added before the change will still NOT be DNSSEC validated.
|
|
|
0c84e1 |
# To force validation of previously added forward zone you need to restart
|
|
|
0c84e1 |
# it. For VPNs this can be done by restart NetworkManager.
|
|
|
0c84e1 |
validate_connection_provided_zones=yes
|
|
|
0c84e1 |
|
|
|
0c84e1 |
# add_wifi_provided_zones:
|
|
|
0c84e1 |
# ------------------------
|
|
|
0c84e1 |
# Setts if domains provided by WiFi connection are configured as forward zones
|
|
|
0c84e1 |
# into unbound.
|
|
|
0c84e1 |
# Possible options are:
|
|
|
0c84e1 |
#
|
|
|
0c84e1 |
# add_wifi_provided_zones=yes - Domains provided by ANY WiFi connection will
|
|
|
0c84e1 |
# be configured as forward zones into unbound.
|
|
|
0c84e1 |
# (NOTE: See the possible security implications
|
|
|
0c84e1 |
# stated below!)
|
|
|
0c84e1 |
#
|
|
|
0c84e1 |
# add_wifi_provided_zones=no - Domains provided by ANY WiFi connection will
|
|
|
0c84e1 |
# NOT be configured as forward zones into unbound.
|
|
|
0c84e1 |
# (NOTE: Forward zones will be still configured
|
|
|
0c84e1 |
# for any other type of connection!)
|
|
|
0c84e1 |
#
|
|
|
0c84e1 |
# NOTICE: Turning ON the addition of WiFi provided domains as forward zones
|
|
|
0c84e1 |
# into unbound may have SECURITY implications such as:
|
|
|
0c84e1 |
# - A WiFi access point can intentionally provide you a domain via DHCP for
|
|
|
0c84e1 |
# which it does not have authority and route all your DNS queries to its
|
|
|
0c84e1 |
# DNS servers.
|
|
|
0c84e1 |
# - In addition to the previous point, if you have the DNSSEC validation
|
|
|
0c84e1 |
# of forward zones turned OFF, the WiFi provided DNS servers can spoof
|
|
|
0c84e1 |
# the IP address for domain names from the provided domain WITHOUT YOU
|
|
|
0c84e1 |
# KNOWING IT!
|
|
|
0c84e1 |
add_wifi_provided_zones=no
|