unbound: Drop certificates for local control connection

These are a cause of worry because they are sometimes generated with
an invalid timestamp and therefore render unbound being unusable.

There is no strong reason to use self-signed certificates for extra
security here.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/core/128/filelists/files b/config/rootfiles/core/128/filelists/files
index 1998a08c01ba2d93dc5b3f5eb5db2ec359019b80..9a34f756b651b26ac8e788bcbf2b3dc8ef650f20 100644 (file)
--- a/config/rootfiles/core/128/filelists/files
+++ b/config/rootfiles/core/128/filelists/files
@@ -5,8 +5,10 @@ var/ipfire/langs
 etc/rc.d/helper/aws-setup
 etc/rc.d/init.d/aws
 etc/rc.d/init.d/firewall
+etc/rc.d/init.d/unbound
 etc/ssl/openssl.cnf
 etc/sysctl.conf
+etc/unbound/unbound.conf
 srv/web/ipfire/cgi-bin/proxy.cgi
 usr/local/bin/xt_geoip_update
 var/ipfire/ovpn/openssl/ovpn.cnf

diff --git a/config/rootfiles/core/128/update.sh b/config/rootfiles/core/128/update.sh
index dc185ed7050e39ded580fc6fc0ce9b07d31610ce..99c036d600ea4e7a2ea23a2886e9a3b05b99aac0 100644 (file)
--- a/config/rootfiles/core/128/update.sh
+++ b/config/rootfiles/core/128/update.sh
@@ -62,6 +62,7 @@ if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then
 fi
 /etc/init.d/sshd restart
 /etc/init.d/apache restart
+/etc/init.d/unbound restart
 
 # This update needs a reboot...
 touch /var/run/need_reboot

diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index 2cc5bab8a23eab251f1256787b515c01f3139f27..e20c3330d7045ac93856ee1eb2e01d7d41b62d83 100644 (file)
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -83,12 +83,8 @@ server:
 
 remote-control:
        control-enable: yes
-       control-use-cert: yes
+       control-use-cert: no
        control-interface: 127.0.0.1
-       server-key-file: "/etc/unbound/unbound_server.key"
-       server-cert-file: "/etc/unbound/unbound_server.pem"
-       control-key-file: "/etc/unbound/unbound_control.key"
-       control-cert-file: "/etc/unbound/unbound_control.pem"
 
 # Import any local configurations
 include: "/etc/unbound/local.d/*.conf"

diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound
index 08007f50a31a0ae51875e9cc9319f9f21f13c1d2..2ef994e963cc1629f5d4ece415f80c036277b2d7 100644 (file)
--- a/src/initscripts/system/unbound
+++ b/src/initscripts/system/unbound
@@ -507,11 +507,6 @@ case "$1" in
 
                eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 
-               # Create control keys at first run
-               if [ ! -r "/etc/unbound/unbound_control.key" ]; then
-                       unbound-control-setup -d /etc/unbound &>/dev/null
-               fi
-
                # Update configuration files
                write_tuning_conf
                write_forward_conf