webmin-unbound Files

Install: download unbound.wbm.gz (or unbound-2.0.wbm.gz, the same file) below and use Webmin → Webmin Configuration → Webmin Modules → Install Module → From uploaded file. Do not use the Source code archives: they are the whole repository, not the module, and Webmin answers "missing a module.info file".

Installazione: scarica unbound.wbm.gz qui sotto e installalo da Webmin → Moduli Webmin → Installa modulo → Da file caricato. Non usare gli archivi Source code: contengono tutto il repository, non il modulo.

What's new in 2.0

• Check Configuration no longer reports that this system bypasses Pi-hole when /etc/resolv.conf has no nameserver line: in that case the system asks the local DNS server.
• The socket buffer warning gives the full path of sysctl, which plain su leaves out of root's PATH, and says that Unbound uses the new size from its next restart.
• The Use Only Unbound button warns that Pi-hole then has no fallback server.
• Two more button labels no longer match other texts, so the Authentic theme always styles them the same way.
• Fixed: removing all addresses or hosts of a forward or stub zone (for example to switch from addresses to hosts), or all URLs and primaries of an authoritative or RPZ zone, left the old lines in place.
• Fixed: a line added to a zone right after its last line was deleted could land in the next zone when there was no blank line between them.
• Saving an options page without changes no longer rewrites lines that are only quoted differently (like auto-trust-anchor-file in Debian's own file), and no longer creates an empty server: section.
• Check Configuration tests real DNSSEC answers: a signed domain must resolve and dnssec-failed.org, whose signature is broken on purpose, must be refused, both by Unbound and through Pi-hole, so another upstream server answering in Pi-hole's place shows up.
• Check Configuration warns when the automatic trust anchor hasn't been updated for a month, and checks the age of a root hints file if one is set.
• The Pi-hole link page shows the share of forwarded queries that Unbound really answered, from Pi-hole's statistics, with the other upstream servers.
• Once Unbound is Pi-hole's only upstream server, the Pi-hole link page offers to create a System and Server Status monitor for it.
• Fixed: changing or deleting an A or AAAA record left its reverse (PTR) record behind, pointing at the old address or at a name that no longer existed. The same happened when bulk import replaced a record or several records were deleted at once.
• Fixed: bulk import in record format took names with a dot as relative (nas.lan became nas.lan.lan.) and left short names in CNAME, NS, PTR, MX and SRV targets unqualified, so Unbound read "mx1" as the top-level name "mx1.". Both now follow the rule shown on the page; service names like _sip._tcp stay in the zone.
• Fixed: a TLS authentication name after a server address (9.9.9.9@853#dns.quad9.net) was read as a comment, so it disappeared from the form and was lost on the next save. Such an address is now refused unless DNS-over-TLS is on.
• Fixed: deleting forward or stub zones from the zone list left their private-domain and domain-insecure lines behind, and deleting the last RPZ zone left respip in module-config.
• An authoritative or RPZ zone that only has a zone file is refused when the file does not exist, because Unbound would fail to start or reload with it (unbound-checkconf 1.26 does not catch this).
• Cache and Statistics says the memory use is not reported, instead of 0 bytes, when extended-statistics is off.
• With Pi-hole, the Unbound cache tile says it counts only what gets past Pi-hole's cache, which is why its rate is low.
• Pi-hole: an invalid time when turning blocking off is refused, instead of turning blocking off until it is turned back on.
• Pi-hole query log: the domain filter finds the text anywhere in the name (Pi-hole only matched it exactly), and the column with the Allow and Deny links has a heading.
• Tests: the page rendering checks really fail now when a page shows an error (a list-context bug made them always pass), with new tests for the fixes above.
• Apply is safe on a system whose only DNS server is Unbound: if Unbound stops after loading the new configuration, the last configuration it ran with is put back and Unbound is started again, so DNS keeps working. The configuration that failed is kept in /etc/webmin/unbound/failed. This can be turned off in the module configuration.
• Changes to listening addresses, ports, protocols, threads, user or chroot now make Apply restart Unbound instead of reloading it. A reload keeps the old sockets, so a wrong address only failed at the next restart or reboot, when nothing could put the old configuration back.
• An Unbound process that has exited but not yet been reaped is no longer taken as running.
• A save that fails no longer leaves an empty webmin.conf behind: the file is only created when something is written to it.
• Pi-hole pages that change something only accept a form POST, so a link or an image on another site cannot change Pi-hole. The Allow and Deny links in the query log and domain search are now buttons.
• Pi-hole file:// lists must point to a file in /etc/pihole, or in the directories set in the module configuration, and cannot use "..".
• Flushing one name from Unbound's cache says that Pi-hole's whole cache was cleared too, because Pi-hole cannot remove a single name.
• Tests: new tests/rollback.pl runs a real Unbound and checks that a failed apply puts back the working configuration.

Webmin, Unbound and Pi-hole are trademarks of their respective holders. This is an independent third-party project, not affiliated with or endorsed by them.

SHA-256 unbound-2.0.wbm.gz: 20e783a0a415d27c8ef32c0013628976eca8484d05b1f7e2305a879646f0d620