El 22/11/11 15:16, Nick Holland escribis:
> On 11/22/11 10:31, Claer wrote:
>> On Tue, Nov 22 2011 at 13:16, Jan Stary wrote:
>>> On Nov 22 08:16:21, Nick Holland wrote:
Long term, BIND is done.
Long term, unbound will probably be replacing it in OpenBSD.
IF you are doing anything beyond a simple resolver, I'd agree
completely...take the time to learn unbound/nsd (or djbdns or ...)
However, right now, unbound is a package requiring separate install and
maintenance.
>>>
>>> Nick, would you please clarify:
>>>
>>> nsd(8) is in base, unbound is a package;
>>> yet it is unbound who's gonna be the default resolver?
>>> What is the status of nsd then? (I am just about to try
>>> it on one of my resolvers).
>>
>> NSD is just an autoritative name server that doesn't do cache and does not
>> answer recursive queries.
>> nsd and unbound are complementary.
>>
I've changed several DNS's from bind to unbound without problems and
with a few great improvements, lower RAM usage, improved Query Speed,
between others.
Configuration is really easy as unbound.conf is nicely documented.
unbound-control(8) it's quite helpful allows you tu run the server and
do administrative tasks such as remove a recursed zone from memory so
you can update it
again by making a query, reload configuration, etc.
Another good thing is that DNSSEC configuration is relatively simple
using unbound-anchor(8).
>> nsd and unbound are complementary.
Well... Unbound allows you to resolve and to be authoritative, so it
does both functions, and it works well.
I've tryed before unbound(8), MaraDNS, and in a small enviroment it
behaves properly, you can do both tasks too, but on boxes with high
traffic it didn't run well (a lot of "Didn't spawn thread" messages),
maybe my fault, but I didn't want to modify any OpenBSD default
configuration, and unbound worked fine out-of-the-box without tunning.
Some people even recommended djbdns, but again, unbound is in
packages/ports, secured by chroot(), good security record, removed root
privileges, I really didn't feel the need to re-invent the wheel.
If you are worried about performance, I can tell you that it runs
at 400 ~ 500 queries/second smoothly on 5.0 amd64 GENERIC.MP with
num-threads: 2 configured on unbound.conf(5).
thanks to jakob@ for porting !
