Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to have an encrypted DNS queries + a DNS Cache + Domain Name System Security Extensions (DNSSEC) .

I used this bash script to install DNSCrypt and I choosed to use dnscrypt.eu servers :

DNSCrypt.eu (no logs)

Holland
Server address:
176.56.237.171:443
Provider name
2.dnscrypt-cert.dnscrypt.eu
Public key
67C0:0F2C:21C5:5481:45DD:7CB4:6A27:1AF2:EB96:9931:40A3:09B6:2B8D:1653:1185:9C66

I installed ( apt-get install unbound ) Unbound and my unbound.conf file contains :

#
# See the unbound.conf(5) man page.
#
# See /usr/share/doc/unbound/examples/unbound.conf for a commented
# reference config file.

server:
    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"
server:
verbosity: 1
num-threads: 4                                                        
interface: 0.0.0.0
 do-ip4: yes
 do-udp: yes
 do-tcp: yes
 access-control: 192.168.0.0/24 allow                
 do-not-query-localhost: no
 chroot: ""       
 logfile: "/var/log/unbound.log"             
 use-syslog: no 
 hide-identity: yes
 hide-version: yes 
 harden-glue: yes
 harden-dnssec-stripped: yes
 use-caps-for-id: yes       
 private-domain: "localhost"      
 local-zone: "localhost." static
 local-data: "freebox.localhost. IN A 192.168.0.254"                                              
 local-data-ptr: "192.168.0.254 freebox.localhost"
python:
remote-control:
forward-zone:
  name: "."
  forward-addr: 127.0.0.1@40

Like you see, I added this line to activate DNSSEC :

server:
    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key" 

Now, when I enter : sudo service unbound start This is the error that I get :

     * Restarting recursive DNS server unbound
[1382606879] unbound[8878:0] error: bind: address already in use
[1382606879] unbound[8878:0] fatal error: could not open ports

My question is of course about the error ! Also, is it useful to use DNSSEC in an ordinary laptop (not a DNS server) or it is just useful for DNS Servers ?

share|improve this question
1  
DNSSEC is suppose to protect your DNS requests on the way. Thus one of the endpoint (your client or your trusted recursive dns server) should use DNSSEC. The best is of course on your laptop, as you could trust it. But if you use DNSSEC on your recursive DNS server on your gateway (gateway you trust), you do not need to have it on end clients. –  Jiri Xichtkniha Oct 24 '13 at 10:23
add comment

2 Answers 2

Your dnscrypt proxy already uses port 53. I bet :)

share|improve this answer
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. –  Anthon Oct 24 '13 at 10:17
    
"My question is of course about the error !" - obvious. Something is using port 53, or am i wrong? Before starting unbound it would be nice to see netstat output. –  Jiri Xichtkniha Oct 24 '13 at 10:21
add comment
up vote 0 down vote accepted

Thanks @Jiri Xichtkniha and @Anthon

When typing

sudo lsof -nPi | grep \:53

I can see that bind is also listening on the same port :

TCP *:53 (LISTEN)

I made then a modification on /etc/unbound/unbound.conf by adding this line :

port:533

ps : The port number, default 53, on which the server responds to queries.

Another solution is to change the port of Bind from 53 to another.

I hope it will help others having the same problem.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.