Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1278261

Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution

Show all headers | View raw

Package: tech-ctte
Severity: normal

I am escalating bug #1124968 to the Technical Committee after
disagreement with the unbound maintainer.

SUMMARY OF DISPUTE:

The unbound package has a resolvconf hook enabled by default that
silently forwards all DNS queries to upstream resolvers (ISP, hosting
provider) instead of performing recursive resolution.

The maintainer argues:
This is necessary for captive portal scenarios,
and therefore working out of the box in all contexts.

I argue:
- It currently does not work as a resolver out of the box
(as soon as you have a DHCP server on the network, so lots of cases)
- This defeats unbound's documented purpose as a recursive resolver
- It creates a silent privacy leak (all DNS queries sent to third parties)
- It's a security issue (cache poisoning exposure, DNSSEC bypass)
- Users installing a "recursive resolver" expect recursive resolution
- Captive portals are an edge case for unbound's typical userbase

The maintainer marked the bug "wontfix" and suggested escalation.

RELEVANT BUG: #1124968
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1124968

PROPOSED RESOLUTION:
- Default to disabled hook (recursive resolution)
- Document how to enable forwarding for captive portal scenarios

OTHER SOLUTION MAY BE:
- Disable (default) / Enable upstream forwarding via config file
- Offer to choose upstream servers (default DHCP)

Thank you
LRob

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution LRob <debiantracker@lrob.fr> - 2026-01-13 20:30 +0100
  Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution Helmut Grohne <helmut@subdivi.de> - 2026-01-13 22:40 +0100
    Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution LRob <debiantracker@lrob.fr> - 2026-01-13 23:10 +0100
      Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution Helmut Grohne <helmut@subdivi.de> - 2026-01-14 20:20 +0100
        Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution LRob <debiantracker@lrob.fr> - 2026-01-15 06:20 +0100
  Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution Daniel Baumann <daniel@debian.org> - 2026-01-15 11:20 +0100
  Bug#1125411: Info received (Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution) LRob <debiantracker@lrob.fr> - 2026-01-15 14:50 +0100
    Bug#1125411: Info received (Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution) Helmut Grohne <helmut@subdivi.de> - 2026-01-16 21:50 +0100
      Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution "Andrea Pappacoda" <tachi@debian.org> - 2026-01-17 00:20 +0100
      Bug#1125411: Info received (Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution) LRob <debiantracker@lrob.fr> - 2026-01-18 04:50 +0100
        Bug#1125411: Info received (Bug#1125411: tech-ctte: Unbound resolvconf hook default breaks recursive resolution) Helmut Grohne <helmut@subdivi.de> - 2026-01-25 11:10 +0100

csiph-web