NAME

       rlm_unbound - FreeRADIUS Module

DESCRIPTION

       Each  instance  of rlm_unbound provides an embedded DNS client for performing DNS lookups.  Each instance
       may be configured separately to query different DNS horizons, change DNSSEC options, etc.

       The module is primarily intended for use by other modules through internal APIs, and so, instances should
       be initialized earlier than those modules which use them.  Each instance  does  also  provide  some  xlat
       functionalities for general use and for troubleshooting.

       Each instance of rlm_unbound may take the following parameters:

       filename
              This  file  must  exist  and  must point to a valid libunbound configuration file.  The default is
              ${raddbdir}/mods-config/unbound/default.conf.

       timeout
              While libunbound provides an asyncronous API for internal use, using any xlat is done syncronously
              from the perspective of unlang.  This value limits the amount of time a request will wait for  DNS
              to  respond,  after  which the xlat will fail.  The default is 3000 milliseconds.  This setting is
              independent of any libunbound configuration values.

       resolvconf
              Full path of a resolv.conf file to load resolver details from.  If this is not set then libunbound
              will query root DNS servers.

       hosts  Full path of a hosts file to load.  This provides a mechanism for local overrides to  names  which
              would  otherwise  not  resolve  or  need  different  results to those which a DNS resolution would
              provide.

       An instance named, for example, "dns" will provide the following xlat functionalities:

       %{dns-a:<owner>}
              Performs an A lookup for the owner name, returning a stringified IPv4 address.  Only the  first  A
              record in the RRSET will be returned.

       %{dns-aaaa:<owner>}
              Performs  an AAAA lookup for the owner name, returning a stringified IPv6 address.  Only the first
              AAAA record in the RRSET will be returned.

       %{dns-ptr:<owner>}
              Performs a PTR lookup for the owner.

CAVEATS

       Logging from rlm_unbound can be problematic, especialy if more than one instantiation of  the  module  is
       used.   This is due to the need for additional features in the underlying libunbound which hopefully will
       be enhanced over time.

       There is a potential for a FreeRADIUS server using  rlm_unbound  to  either  fail  to  terminate  cleanly
       (leaving zombie processes, failing to clean up other modules, and hanging after a SIGTERM until a SIGKILL
       is sent) or to fail valgrind checks during termination when run with -m.  Likewise this problem will rely
       on  upstream  enhancements  before it can be fixed, and the exact behavior may change in interim releases
       until then.

       The logging behavior of rlm_unbound may vary depending on whether FreeRADIUS is compiled with support for
       threads.

FILES

       /etc/freeradius/3.0/modules-available/rlm_unbound /etc/freeradius/3.0/modules-config/unbound/

SEE ALSO

       radiusd(8), radiusd.conf(5) libunbound(3) unbound.conf(5)

AUTHOR

       Brian S. Julin, bjulin@clarku.edu

                                                   8 July 2013                                    rlm_unbound(5)