diff --git a/lib/configfiles/gentoo.xml b/lib/configfiles/gentoo.xml index d70e79ac..908cb9ea 100644 --- a/lib/configfiles/gentoo.xml +++ b/lib/configfiles/gentoo.xml @@ -2880,7 +2880,7 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin - + diff --git a/lib/configfiles/jessie.xml b/lib/configfiles/jessie.xml index c50d4a33..41151e00 100644 --- a/lib/configfiles/jessie.xml +++ b/lib/configfiles/jessie.xml @@ -350,33 +350,55 @@ exit "$RETVAL" +# allow-axfr-ips=127.0.0.0/8,::1, ################################# -# allow-recursion List of netmasks that are allowed to recurse +# allow-dnsupdate-from A global setting to allow DNS updates from these IP ranges. +# +# allow-dnsupdate-from=127.0.0.0/8,::1 + +################################# +# allow-recursion List of subnets that are allowed to recurse # allow-recursion=127.0.0.1 ################################# -# allow-recursion-override Local data even about hosts that don't exist will -# override the internet. (on/off) +# also-notify When notifying a domain, also notify these nameservers # -# allow-recursion-override= +# also-notify= + +################################# +# any-to-tcp Answer ANY queries with tc=1, shunting to TCP +# +# any-to-tcp=no ################################# # cache-ttl Seconds to store packets in the PacketCache # # cache-ttl=20 +################################# +# carbon-interval Number of seconds between carbon (graphite) updates +# +# carbon-interval=30 + +################################# +# carbon-ourname If set, overrides our reported hostname for carbon stats +# +# carbon-ourname= + +################################# +# carbon-server If set, send metrics in carbon (graphite) format to this server +# +# carbon-server= + ################################# # chroot If set, chroot to this directory for more security # -# chroot=/var/spool/powerdns +# chroot= ################################# # config-dir Location of configuration directory (pdns.conf) @@ -398,15 +420,55 @@ config-dir=/etc/powerdns # daemon=yes +################################# +# default-ksk-algorithms Default KSK algorithms +# +# default-ksk-algorithms=rsasha256 + +################################# +# default-ksk-size Default KSK size (0 means default) +# +# default-ksk-size=0 + +################################# +# default-soa-mail mail address to insert in the SOA record if none set in the backend +# +# default-soa-mail= + ################################# # default-soa-name name to insert in the SOA record if none set in the backend # # default-soa-name=a.misconfigured.powerdns.server +################################# +# default-ttl Seconds a result is valid if not set otherwise +# +# default-ttl=3600 + +################################# +# default-zsk-algorithms Default ZSK algorithms +# +# default-zsk-algorithms=rsasha256 + +################################# +# default-zsk-size Default ZSK size (0 means default) +# +# default-zsk-size=0 + +################################# +# direct-dnskey Fetch DNSKEY RRs from backend during DNSKEY synthesis +# +# direct-dnskey=no + ################################# # disable-axfr Disable zonetransfers but do allow TCP queries # -disable-axfr=yes +# disable-axfr=no + +################################# +# disable-axfr-rectify Disable the rectify step during an outgoing AXFR. Only required for regression testing. +# +# disable-axfr-rectify=no ################################# # disable-tcp Do not listen to TCP queries @@ -419,9 +481,54 @@ disable-axfr=yes # distributor-threads=3 ################################# -# fancy-records Process URL and MBOXFW records +# do-ipv6-additional-processing Do AAAA additional processing # -# fancy-records=no +# do-ipv6-additional-processing=yes + +################################# +# edns-subnet-processing If we should act on EDNS Subnet options +# +# edns-subnet-processing=no + +################################# +# entropy-source If set, read entropy from this file +# +# entropy-source=/dev/urandom + +################################# +# experimental-api-key REST API Static authentication key (required for API use) +# +# experimental-api-key= + +################################# +# experimental-api-readonly If the JSON API should disallow data modification +# +# experimental-api-readonly=no + +################################# +# experimental-dname-processing If we should support DNAME records +# +# experimental-dname-processing=no + +################################# +# experimental-dnsupdate Enable/Disable DNS update (RFC2136) support. Default is no. +# +# experimental-dnsupdate=no + +################################# +# experimental-json-interface If the webserver should serve JSON data +# +# experimental-json-interface=no + +################################# +# experimental-logfile Filename of the log file for JSON parser +# +# experimental-logfile=/var/log/pdns.log + +################################# +# forward-dnsupdate A global setting to allow DNS update packages that are for a Slave domain, to be forwarded to the master. +# +# forward-dnsupdate=yes ################################# # guardian Run within a guardian process @@ -429,14 +536,16 @@ disable-axfr=yes guardian=yes ################################# -# launch Which backends to launch and order to query them in +# include-dir Include *.conf files from this directory # -launch=bind +# include-dir= +include-dir=/etc/powerdns/pdns.d ################################# -# lazy-recursion Only recurse if question cannot be answered locally +# launch Which backends to launch and order to query them in # -lazy-recursion=yes +# launch= +launch=bind ################################# # load-modules Load this module - supply absolute or relative path @@ -444,34 +553,39 @@ lazy-recursion=yes # load-modules= ################################# -# local-address Local IP address to which we bind +# local-address Local IP addresses to which we bind # local-address=,127.0.0.1 +################################# +# local-address-nonexist-fail Fail to start if one or more of the local-address's do not exist on this server +# +# local-address-nonexist-fail=yes + ################################# # local-ipv6 Local IP address to which we bind # # local-ipv6= +################################# +# local-ipv6-nonexist-fail Fail to start if one or more of the local-ipv6 addresses do not exist on this server +# +# local-ipv6-nonexist-fail=yes + ################################# # local-port The port on which we listen # -local-port=53 +# local-port=53 ################################# -# log-dns-details If PDNS should log failed update requests +# log-dns-details If PDNS should log DNS non-erroneous details # -log-dns-details=yes +# log-dns-details=no ################################# -# log-failed-updates If PDNS should log failed update requests +# log-dns-queries If PDNS should log all incoming DNS queries # -# log-failed-updates= - -################################# -# logfile Logfile to use -# -# logfile=/var/log/pdns.log +# log-dns-queries=no ################################# # logging-facility Log under a specific facility @@ -483,16 +597,41 @@ log-dns-details=yes # # loglevel=4 +################################# +# lua-prequery-script Lua script with prequery handler +# +# lua-prequery-script= + ################################# # master Act as a master # master=yes +################################# +# max-cache-entries Maximum number of cache entries +# +# max-cache-entries=1000000 + +################################# +# max-ent-entries Maximum number of empty non-terminals in a zone +# +# max-ent-entries=100000 + +################################# +# max-nsec3-iterations Limit the number of NSEC3 hash iterations +# +# max-nsec3-iterations=500 + ################################# # max-queue-length Maximum queuelength before considering situation lost # # max-queue-length=5000 +################################# +# max-signature-cache-entries Maximum number of signatures cache entries +# +# max-signature-cache-entries= + ################################# # max-tcp-connections Maximum number of TCP connections # @@ -501,23 +640,58 @@ master=yes ################################# # module-dir Default directory for modules # -module-dir=/usr/lib/powerdns +# module-dir=/usr/lib/TRIPLET/pdns ################################# -# negquery-cache-ttl Seconds to store packets in the PacketCache +# negquery-cache-ttl Seconds to store negative query results in the QueryCache # # negquery-cache-ttl=60 ################################# -# out-of-zone-additional-processing Do out of zone additional processing +# no-shuffle Set this to prevent random shuffling of answers - for regression testing # -# out-of-zone-additional-processing=no +# no-shuffle=off ################################# -# query-cache-ttl Seconds to store packets in the PacketCache +# only-notify Only send AXFR NOTIFY to these IP addresses or netmasks +# +# only-notify=0.0.0.0/0,::/0 + +################################# +# out-of-zone-additional-processing Do out of zone additional processing +# +# out-of-zone-additional-processing=yes + +################################# +# overload-queue-length Maximum queuelength moving to packetcache only +# +# overload-queue-length=0 + +################################# +# pipebackend-abi-version Version of the pipe backend ABI +# +# pipebackend-abi-version=1 + +################################# +# prevent-self-notification Don't send notifications to what we think is ourself +# +# prevent-self-notification=yes + +################################# +# query-cache-ttl Seconds to store query results in the QueryCache # # query-cache-ttl=20 +################################# +# query-local-address Source IP address for sending queries +# +# query-local-address=0.0.0.0 + +################################# +# query-local-address6 Source IPv6 address for sending queries +# +# query-local-address6=:: + ################################# # query-logging Hint backends that queries should be logged # @@ -529,24 +703,44 @@ module-dir=/usr/lib/powerdns # queue-limit=1500 ################################# -# query-local-address The IP address to use as a source address for sending -# queries. -# query-local-address= - -################################# -# receiver-threads Number of receiver threads to launch +# receiver-threads Default number of receiver threads to start # # receiver-threads=1 ################################# -# recursive-cache-ttl Seconds to store packets in the PacketCache +# recursive-cache-ttl Seconds to store packets for recursive queries in the PacketCache # # recursive-cache-ttl=10 ################################# # recursor If recursion is desired, IP address of a recursing nameserver # -# recursor= +# recursor=no + +################################# +# retrieval-threads Number of AXFR-retrieval threads for slave operation +# +# retrieval-threads=2 + +################################# +# reuseport Enable higher performance on compliant kernels by using SO_REUSEPORT allowing each receiver thread to open its own socket +# +# reuseport=no + +################################# +# security-poll-suffix Domain name from which to query security update notifications +# +# security-poll-suffix=secpoll.powerdns.com. + +################################# +# send-root-referral Send out old-fashioned root-referral instead of ServFail in case of no authority +# +# send-root-referral=no + +################################# +# server-id Returned when queried for 'server.id' TXT or NSID, defaults to hostname - disabled or custom +# +# server-id= ################################# # setgid If set, change group id to this gid for more security @@ -559,9 +753,9 @@ setgid=pdns setuid=pdns ################################# -# skip-cname Do not perform CNAME indirection for each query +# signing-threads Default number of signer threads to start # -# skip-cname=no +# signing-threads=3 ################################# # slave Act as a slave @@ -574,55 +768,75 @@ setuid=pdns # slave-cycle-interval=60 ################################# -# smtpredirector Our smtpredir MX host +# slave-renotify If we should send out notifications for slaved updates # -# smtpredirector=a.misconfigured.powerdns.smtp.server +# slave-renotify=no ################################# -# soa-minimum-ttl Default SOA mininum ttl -# -# soa-minimum-ttl=3600 - -################################# -# soa-refresh-default Default SOA refresh -# -# soa-refresh-default=10800 - -################################# -# soa-retry-default Default SOA retry -# -# soa-retry-default=3600 - -################################# -# soa-expire-default Default SOA expire +# soa-expire-default Default SOA expire # # soa-expire-default=604800 ################################# -# soa-serial-offset Make sure that no SOA serial is less than this number +# soa-minimum-ttl Default SOA minimum ttl # -# soa-serial-offset=0 +# soa-minimum-ttl=3600 + +################################# +# soa-refresh-default Default SOA refresh +# +# soa-refresh-default=10800 + +################################# +# soa-retry-default Default SOA retry +# +# soa-retry-default=3600 ################################# # socket-dir Where the controlsocket will live # -socket-dir=/var/run +# socket-dir=/var/run ################################# -# strict-rfc-axfrs Perform strictly rfc compliant axfrs (very slow) +# tcp-control-address If set, PowerDNS can be controlled over TCP on this address # -# strict-rfc-axfrs=no +# tcp-control-address= ################################# -# urlredirector Where we send hosts to that need to be url redirected +# tcp-control-port If set, PowerDNS can be controlled over TCP on this address # -# urlredirector=127.0.0.1 +# tcp-control-port=53000 ################################# -# use-logfile Use a log file +# tcp-control-range If set, remote control of PowerDNS is possible over these networks only # -# use-logfile=yes +# tcp-control-range=127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fe80::/10 +################################# +# tcp-control-secret If set, PowerDNS can be controlled over TCP after passing this secret +# +# tcp-control-secret= + +################################# +# traceback-handler Enable the traceback handler (Linux only) +# +# traceback-handler=yes + +################################# +# trusted-notification-proxy IP address of incoming notification proxy +# +# trusted-notification-proxy= + +################################# +# udp-truncation-threshold Maximum UDP response size before we truncate +# +# udp-truncation-threshold=1680 + +################################# +# version-string PowerDNS version in packets - full, anonymous, powerdns or custom +# + +version-string=powerdns ################################# # webserver Start a webserver for monitoring # @@ -633,6 +847,11 @@ socket-dir=/var/run # # webserver-address=127.0.0.1 +################################# +# webserver-allow-from Webserver access is only allowed from these subnets +# +# webserver-allow-from=0.0.0.0/0,::/0 + ################################# # webserver-password Password required for accessing the webserver # @@ -648,21 +867,6 @@ socket-dir=/var/run # # webserver-print-arguments=no -################################# -# wildcard-url Process URL and MBOXFW records -# -# wildcard-url=no - -################################# -# wildcards Honor wildcards in the database -# -# wildcards= - -################################# -# version-string What should PowerDNS return for version -# allowed methods are anonymous / powerdns / full / custom -version-string=powerdns - include=/etc/powerdns/pdns.d ]]> @@ -3356,6 +3560,11 @@ LoadModule mod_ifsession.c # + +DefaultRoot ~ +RequireValidShell off +AuthOrder mod_sql.c + # # Choose a SQL backend among MySQL or PostgreSQL. # Both modules are loaded in default configuration, so you have to specify the backend @@ -3369,6 +3578,9 @@ SQLAuthenticate on # # Use both a crypted or plaintext password SQLAuthTypes Crypt + +SQLAuthenticate users* groups* + # # Connection SQLConnectInfo @ @@ -3662,7 +3874,7 @@ PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin - + - + diff --git a/lib/configfiles/rhel_centos.xml b/lib/configfiles/rhel_centos.xml index b5131138..b749d4dd 100644 --- a/lib/configfiles/rhel_centos.xml +++ b/lib/configfiles/rhel_centos.xml @@ -2299,7 +2299,7 @@ PATH=/sbin:/bin:/usr/sbin:/usr/bin - + - + diff --git a/lib/configfiles/wheezy.xml b/lib/configfiles/wheezy.xml index eb5d17ec..4749de06 100644 --- a/lib/configfiles/wheezy.xml +++ b/lib/configfiles/wheezy.xml @@ -4935,7 +4935,7 @@ PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin - +