diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml index 4fe74046b..923e5c697 100644 --- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml @@ -35,4 +35,10 @@ true Set one or more hosts to send your DNS queries if the request is unknown. + + general.logsize + + text + Set the amount how big a logfile can growth. + diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml index 8b76d48da..450c2edbd 100644 --- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml +++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml @@ -1,7 +1,7 @@ //OPNsense/bind/general BIND configuration - 1.0.1 + 1.0.2 0 @@ -28,5 +28,12 @@ N Y + + 5 + Y + 1 + 1000 + Choose a value between 1 and 1000. + diff --git a/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt b/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt index d087c736b..b1b7fdc18 100644 --- a/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt +++ b/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt @@ -127,7 +127,7 @@ $( document ).ready(function() { $("#saveAct_dnsbl").click(function(){ saveFormToEndpoint(url="/api/bind/dnsbl/set", formid='frm_dnsbl_settings',callback_ok=function(){ - $("#saveAct_acl_progress").addClass("fa fa-spinner fa-pulse"); + $("#saveAct_dnsbl_progress").addClass("fa fa-spinner fa-pulse"); ajaxCall(url="/api/bind/service/dnsbl", sendData={}, callback=function(data,status) { ajaxCall(url="/api/bind/service/reconfigure", sendData={}, callback=function(data,status) { ajaxCall(url="/api/bind/service/status", sendData={}, callback=function(data,status) { diff --git a/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh b/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh index 098437c85..82e1d34cb 100755 --- a/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh +++ b/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh @@ -38,47 +38,49 @@ mkdir -p ${WORKDIR} easylist() { # EasyList ${FETCH} https://justdomains.github.io/blocklists/lists/easylist-justdomains.txt -o ${WORKDIR}/easylist-raw - sed "/\.$/d" ${WORKDIR}/easylist-raw > ${WORKDIR}/easylist + sed "/\.$/d" ${WORKDIR}/easylist-raw | sed "/^#/ d" | sed "/\_/d" > ${WORKDIR}/easylist rm ${WORKDIR}/easylist-raw } easyprivacy() { # EasyPrivacy ${FETCH} https://justdomains.github.io/blocklists/lists/easyprivacy-justdomains.txt -o ${WORKDIR}/easyprivacy-raw - sed "/\.$/d" ${WORKDIR}/easyprivacy-raw > ${WORKDIR}/easyprivacy + sed "/\.$/d" ${WORKDIR}/easyprivacy-raw | sed "/^#/ d" | sed "/\_/d" > ${WORKDIR}/easyprivacy rm ${WORKDIR}/easyprivacy-raw } adguard() { # AdGuard ${FETCH} https://justdomains.github.io/blocklists/lists/adguarddns-justdomains.txt -o ${WORKDIR}/adguard-raw - sed "/\.$/d" ${WORKDIR}/adguard-raw > ${WORKDIR}/adguard + sed "/\.$/d" ${WORKDIR}/adguard-raw | sed "/^#/ d" | sed "/\_/d" > ${WORKDIR}/adguard rm ${WORKDIR}/adguard-raw } nocoin() { # NoCoin - ${FETCH} https://justdomains.github.io/blocklists/lists/nocoin-justdomains.txt -o ${WORKDIR}/nocoin + ${FETCH} https://justdomains.github.io/blocklists/lists/nocoin-justdomains.txt -o ${WORKDIR}/nocoin-raw + sed "/\.$/d" ${WORKDIR}/nocoin-raw | sed "/^#/ d" | sed "/\_/d" > ${WORKDIR}/nocoin + rm ${WORKDIR}/nocoin-raw } rwtracker() { # RansomWare Tracker abuse.ch - ${FETCH} https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt -o ${WORKDIR}/rwtracker-comments - sed '/^#/ d' ${WORKDIR}/rwtracker-comments > ${WORKDIR}/rwtracker - rm ${WORKDIR}/rwtracker-comments + ${FETCH} https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt -o ${WORKDIR}/rwtracker-raw + sed "/\.$/d" ${WORKDIR}/rwtracker-raw | sed "/^#/ d" | sed "/\_/d" > ${WORKDIR}/rwtracker + rm ${WORKDIR}/rwtracker-raw } mwdomains() { # MalwareDomains - ${FETCH} http://malwaredomains.lehigh.edu/files/justdomains -o ${WORKDIR}/malwaredomains-comments - sed '/^#/ d' ${WORKDIR}/malwaredomains-comments > ${WORKDIR}/malwaredomains - rm ${WORKDIR}/malwaredomains-comments + ${FETCH} http://malwaredomains.lehigh.edu/files/justdomains -o ${WORKDIR}/malwaredomains-raw + sed "/\.$/d" ${WORKDIR}/malwaredomains-raw | sed "/^#/ d" | sed "/\_/d" > ${WORKDIR}/malwaredomains + rm ${WORKDIR}/malwaredomains-raw } install() { # Put all files in correct format for FILE in $(find ${WORKDIR} -type f); do - awk '{ print "zone " $1 " " $2 " {type master; file \"/usr/local/etc/namedb/master/blacklist.db\"; };" }' ${FILE} | sort -u > ${FILE}.inc + awk '{ print "zone " $1 " " $2 " {type master; file \"/usr/local/etc/namedb/master/blacklist.db\"; notify no; };" }' ${FILE} | sort -u > ${FILE}.inc done # Merge resulting files (/dev/null in case there are none) cat $(find ${WORKDIR} -type f -name "*.inc") /dev/null | sort -u > ${DESTDIR}/dnsbl.inc diff --git a/dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh b/dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh index acc18a206..e46b77b4b 100755 --- a/dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh +++ b/dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh @@ -11,3 +11,7 @@ chmod 755 /var/dump mkdir -p /var/stats chown -R bind:bind /var/stats chmod 755 /var/stats + +mkdir -p /var/log/named +chown -R bind:bind /var/log/named +chmod 755 /var/log/named diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS index e9c3be7e8..78bda9d92 100644 --- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS @@ -1,3 +1,4 @@ blacklist.db:/usr/local/etc/namedb/master/blacklist.db named:/etc/rc.conf.d/named named.conf:/usr/local/etc/namedb/named.conf +rndc.conf:/usr/local/etc/namedb/rndc.conf diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf index 801e31d7a..299cf9a3d 100644 --- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf @@ -28,6 +28,15 @@ options { }; +key "rndc-key" { + algorithm hmac-sha256; + secret "VxtIzJevSQXqnr7h2qerrcwjnZlMWSGGFBndKeNIDfw="; +}; +controls { + inet 127.0.0.1 port 9530 + allow { 127.0.0.1; } keys { "rndc-key"; }; +}; + zone "." { type hint; file "/usr/local/etc/namedb/named.root"; }; zone "localhost" { type master; file "/usr/local/etc/namedb/master/localhost-forward.db"; }; @@ -40,4 +49,27 @@ include "/usr/local/etc/namedb/dnsbl.inc"; {% endif %} {% endif %} +logging { + channel default_log { + file "/var/log/named/named.log" versions 3 size {{ OPNsense.bind.general.logsize }}m; + print-time yes; + print-severity yes; + print-category yes; + }; + + channel query_log { + file "/var/log/named/query.log" versions 3 size {{ OPNsense.bind.general.logsize }}m; + print-time yes; + }; + + channel rpz_log { + file "/var/log/named/rpz.log" versions 3 size {{ OPNsense.bind.general.logsize }}m; + print-time yes; + }; + + category default { default_log; }; + category general { default_log; }; + category queries { query_log; }; + category rpz { rpz_log; }; +}; {% endif %} diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/rndc.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/rndc.conf new file mode 100644 index 000000000..ec9896739 --- /dev/null +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/rndc.conf @@ -0,0 +1,10 @@ +key "rndc-key" { + algorithm hmac-sha256; + secret "VxtIzJevSQXqnr7h2qerrcwjnZlMWSGGFBndKeNIDfw="; +}; + +options { + default-key "rndc-key"; + default-server 127.0.0.1; + default-port 9530; +};