On 07/09/2012 19:46, Peter Jeremy wrote:
> Firstly, I should note that I'm not against removing bind from base.
Thanks for clarifying.
> I'm merely saying that users are going to need some guidance during
> the transition.
I've never argued against that. I think you misunderstood my flippant
> On 2012-Jul-09 13:52:15 -0700, Doug Barton <dougb@Free...> wrote:
>> On 07/09/2012 13:47, Peter Jeremy wrote:
>>> On 2012-Jul-09 14:15:13 +0200, in freebsd-security, "Andrej (Andy)
>>> Brodnik" <andrej@brod...> wrote:
>>>> Excuse my ignorance - but is there a how-to paper on transition
>>>> from bind to unbound for SOHO?
>> You don't need to transition if you don't want to. Just install BIND
>>from the ports.
> IMHO, this is a copout. If the default response to anyone asking a
> question about transitioning is "install bind" then we might as well
> leave bind in the base system.
3 things to keep in mind in response.
1. We cannot keep BIND in the base system.
2. As above, I didn't say we shouldn't have a transition guide. I said
we don't need one. That may not seem like an important distinction, but
it is. :)
3. People really don't have to transition if they don't want to.
All 3 of these are important points, but 1 and 3 are critical for people
to understand if they are going to participate in this discussion.
> As I see it, FreeBSD systems fall roughly into 3 categories:
> 1) Client systems that need to lookup external DNS servers only.
> 2) SOHO systems that primarily do external lookups but need to
> be internally authoritative about their local network.
> 3) Systems that are primarily DNS servers.
> The third category is clearly a "use ports" case - there's no need
> for the base system to include all the tools necessary to build one
> of the root nameservers.
> The base system _must_ handle the first category - and I'll accept
> advice from dougb@ & des@ that unbound is a good choice for this. The
> issues people seem to have with the change here are the user tools
> to interface with DNS - currently dig(1), host(1) and nslookup(1) -
> and des@ has now adequately covered this.
I think your analysis above is basically correct.
> I think the majority of the remaining unease in this thread comes from
> people who administer systems in the second category. I (and I expect
> lots of other people) use bind for this solely because it is in the
> base system, not because it is the best tool for the job.
Well that's yet another reason to take it out of the base so that people
can analyze this critically. :)
Seriously though, "install BIND from ports" is still a good answer to
this use case. I'd argue that BIND 9. is actually the best tool for
the purpose you outlined, but there's no reason you couldn't use a
combination of unbound and nsd. It would just be different than what
people are used to.
>>> In particular, if unbound has no authoritative server capabilities,
>>> what suggestions are there for handling the private hosts in a SOHO
>> Stub and/or forward zones. The unbound docs have more information.
> But unfortunately no tutorial guides.
> Having looked at the online
> copy of unbound.conf(5), it appears that unbound _does_ have some
> limited server capabilities - this wasn't clear in the original
> proposal. It's not immediately clear to me whether it's adequate for
> my purposes and, if it isn't, what I should use.
You're still stuck on "If it's in the base, it's the thing I have to
use, so the fact that I don't know how to use it is causing me stress."
Get over that, and realize that you can continue to use all the same
stuff you already have, if you install BIND from ports. :)
-----END PGP SIGNATURE-----
freebsd-hackers@free... mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@free..."