diff options
Diffstat (limited to 'network/unbound/rc.unbound')
| -rw-r--r-- | network/unbound/rc.unbound | 83 |
1 files changed, 77 insertions, 6 deletions
diff --git a/network/unbound/rc.unbound b/network/unbound/rc.unbound index d45d6ff255..3c31faf4ef 100644 --- a/network/unbound/rc.unbound +++ b/network/unbound/rc.unbound @@ -5,32 +5,97 @@ UNBOUND=/usr/sbin/unbound CONFIG=/etc/unbound/unbound.conf -PIDFILE=/var/run/unbound/unbound.pid +PIDFILE=/run/unbound/unbound.pid +LOGDIR=/var/log/unbound +KEYFILE=/var/lib/unbound/root.key # Unbound-control is useful but I'm not going to cram it # down your throat. Set this to "yes" to disable unbound-control -# initial setup. +# initial setup. Note that you'll need to disable control port +# in unbound.conf so Unbound will actually start. DISABLE_UNBOUND_CONTROL="no" +# As part of the initial checks, the script makes sure that +# $LOGDIR exists. It's mostly for cases where admin accidentally +# deletes the entire log folder rather than individual logs. +# If you don't use logging at all, have a custom setup or +# just want to skip these checks, set this to "yes". +DISABLE_LOGDIR_CHECKS="no" + initchecks() { + # If auto-trust-anchor-file is enabled and the keyfile doesn't exists in + # /var/lib/unbound, we won't start the daemon. Most(?) errors can be caught + # by /usr/sbin/unbound executable but this one actually allows Unbound to start - + # - only for it to crash a moment later. Running unbound-checkconf on every start up + # would be useful, but it would make noise every time the daemon starts up. + if [ ! -z "$(unbound-checkconf -o auto-trust-anchor-file)" ] && [ ! -e "$KEYFILE" ]; then + echo "ERROR: $KEYFILE not found, yet auto-trust-anchor-file is enabled in $CONFIG" + echo "ERROR: Refusing to start because Unbound would crash." + echo "ERROR: Please generate Unbound Anchor file with the following command:" + echo " # sh /etc/rc.d/rc.unbound generate-key" + echo + echo "...or comment out auto-trust-anchor-file in $CONFIG." + exit 1 + fi + # Look out for a stale pidfile. If there's one, remove it. + # This shouldn't be necessary unless the system was shutdown uncleanly + # or if Unbound crashes. + if [ -e $PIDFILE ] && [ ! $(pidof unbound) ]; then + echo "Looks like Unbound isn't running but there's a stale pid file." + echo "Removing $PIDFILE" + rm -vf $PIDFILE + fi + # Check that /run/unbound exists. If not, create and chown it. if [ ! -e $(dirname $PIDFILE) ]; then mkdir -p $(dirname $PIDFILE) chown unbound:unbound $(dirname $PIDFILE) fi + # Run the initial setup for unbound-control unless it's disabled. + # Mostly relevant for the first time run. if [ ! -e $(dirname $CONFIG)/unbound_server.pem ] && [ "$DISABLE_UNBOUND_CONTROL" == "no" ]; then echo "Unbound-control: unbound_server.pem not found." - echo "Running initial setup: /usr/sbin/unbound-control-setup" + echo "This is normal for the first run." + echo "Running initial setup to generate certificates: /usr/sbin/unbound-control-setup" /usr/sbin/unbound-control-setup || exit 1 + echo "Actually... no need to do anything. It's enabled by default on Slackware :-)" + fi + # Deleted the entire log directory by accident? Oh well, bound to happen. + # Let's fix that right away. + if [ "$DISABLE_LOGDIR_CHECKS" == "no" ] + then + if [ ! -d "$LOGDIR" ]; then + echo -n "Unbound log directory not found. Attempting to recreate it... " + mkdir $LOGDIR && echo "Success!" + fi + if [ $(stat -c "%U:%G" "$LOGDIR") != "unbound:unbound" ]; then + echo -n "Fixing permissions on the log folder $LOGDIR... " + chown -R unbound:unbound $LOGDIR && echo "Success!" + fi fi } +anchorkeygen() { + echo "Generating Unbound Anchor keyfile..." + sudo -u unbound unbound-anchor -f /etc/resolv.conf -R -a /var/lib/unbound/root.key + echo "Done" +} + +checkconfig() { + echo "Checking Unbound configuration file: $CONFIG" + echo "This will run the command: /usr/sbin/unbound-checkconf" + echo "-----START unbound-checkconf output-----" + /usr/sbin/unbound-checkconf + echo "-----END unbound-checkconf output-----" + +} + start() { initchecks if [ -r $PIDFILE ]; then echo 'Unbound is already running!' return else - echo "Starting Unbound DNS validating resolver..." + echo "Starting Unbound..." $UNBOUND -c $CONFIG || echo "Failed to start! The error messages above might help." fi } @@ -40,7 +105,7 @@ stop() { echo 'Unbound is not running.' return fi - echo "Stopping Unbound DNS validating resolver..." + echo "Stopping Unbound..." kill `cat $PIDFILE` rm -f $PIDFILE } @@ -66,11 +131,17 @@ case "$1" in sleep 1 start ;; + 'generate-key') + anchorkeygen + ;; + 'check-config') + checkconfig + ;; 'reload') reload ;; *) - echo "Usage: $0 {start|stop|reload|restart}" + echo "Usage: $0 {start|stop|reload|restart|generate-key|check-config}" exit 1 ;; esac |