Created attachment 187054 [details]
sample quick-start file

1. Get error msg make: "/usr/ports/MK/Users/ssl.mk" line 77: You are using an unsupported SSL provider openssl

openssl is valid. This is an bug in your make file. The make structure handles this for you automatically.

2. The "service unbound restart" command is not working correctly. It leaves my host in a compromised state. Getting entries in /var/log/auth.log about unsuccessfull ftp and ssh logins even though those inbound ports are blocked by firewall rules.

When unbound started by using this console command 
/usr/local/sbin/unbound -c /usr/local/etc/unbound/unbound.conf
no longer having problems with unsuccessfull ftp and ssh login entries in /var/log/auth.log.  

Local_unbound and unbound should be pretty much configured the same way. But comparing /usr/local/etc/rc.d/unbound  to /etc/rc.d/local_unbound it's very easy to see their completely different.

/usr/local/etc/rc.d/unbound should check the unbound.conf file looking for the auto-trust-anchor-file parameter and if there then do the fetch anchor function otherwise skip it.

3. This port is very user un-friendly. The ports system provides the files to simply change this.

 A. Create a file named quick-start and populate with this text

   Quick unbound setup instructions         
          
   1. In the /etc/rc.conf file
      comment out this if it's there  local_unbound_enable="YES"
      add unbound_enable="YES"
      The built-in local_unbound version can not co-exist with the port
      version of unbound. Select one or the other.
      You will need one host re-boot to enable unbound after completing the
      following steps

   2. Delete the contents of the /etc/resolv.conf and add this line
      nameserver 127.0.0.1
      Then make it immutable using "chflags -R schg /etc/resolv.conf"
      This makes it un-writable by anyone, Contents will never change.
      Use "ls -lo /etc/resolv.conf" to see its flags.
      Use "chflags -R noschg /etc/resolv.conf" to return to normal.
      This stops /etc/resolv.conf being refreshed at boot time with DNS
      information from your ISP over riding the nameserver 127.0.0.1
      statement needed to drive host dns requests to unbound.

   3. If you have a LAN behind this host and want those LAN device's
      DNS requests to also go through the hosts unbound server.
      Change the hosts DHCP server conf file DNS IP address to the
      LAN IP address assigned to the host network adapter the LAN is on.
          
   4. unbound comes with a built-in "root zone" which negates the need 
      for a "forward-zone: section" all together. This built-in 
      "root zone" sends DNS requests to the up-stream public DSN
      servers. Verify that your host firewall doesn't have rules
      restricting port 53 to using only your ISP's DNS IP addresses. 
              
   5. Use  service unbound restart  command after making changes to the 
      content of your unbound.conf file. Note: Any unbound.conf content 
      errors causes the unbound server to not start. This means ALL DNS 
      requests go un-serviced, basically your host system and LAN users 
      are dead in the water until you fix things.
      The  service unbound stop  command results in the same thing. 
             
   6. Take note: The unbound man pages are not FreeBSD specific. 
      Unbound is open source software that runs on many different
      platforms. Some statements and ideas expressed are incorrect based
      on the FreeBSD way of doing things.
     
   7. The /usr/local/etc/unbound/unbound.conf.sample file shows all the
      possible options available in the unbound.conf file. The defaults 
      are designed to create a running unbound server. In most all cases
      the following working unbound.conf file contains the default over
      rides necessary for a working unbound server. 

      Copy the following unbound.conf content to 
      /usr/local/etc/unbound/unbound.conf

  # Start of the working unbound.conf file.
  # Server config section.
              
  server:
           
  # For the unbound port/package version use this
      directory: /usr/local/etc/unbound
      chroot: "/usr/local/etc/unbound"
      chroot: ""    # disable chroot
      pidfile: /usr/local/etc/unbound/unbound.pid
    
  # Specify the interfaces to answer queries from by ip-address.
  # The default is to listen to localhost (127.0.0.1 and ::1) only.
  # Specify 0.0.0.0 and ::0 to bind to all available interfaces.
      interface: ::0        # listen on all ipv6 interfaces
      interface: 0.0.0.0    # listen on all ipv4 interfaces
              
  # Control which clients are allowed to make (recursive) queries
  # to this server. Specify classless netblocks with /size and action.
  # By default everything is refused, except for localhost.
  # Example 10.0.0.0/8 is the ip address block assigned to the LAN.
      access-control: 10.0.0.0/8 allow
      access-control: 127.0.0.0/8 allow 
                  
  # Remote control config section.
  # Remote control must be enabled before the unbound-control(8)
  # command can be used to send commands to the running unbound server.
  # To enable security, execute the unbound-control-setup command 
  # to set up the keys and certificates.
  # This remote-control: section enables remote-control with
  # security disabled for use on this host only.
             
  remote-control:
      control-enable: yes
      control-interface: /var/run/unbound.ctl
      control-use-cert: no
             
 B. Change the Makefile to install the quick-start file into 
    /usr/local/share/doc/unbound/quick-start

 C. Add a pkg-message file to the make files containing this content:
#########################################################################

     For unbound quick setup instructions read;
     /usr/local/share/doc/unbound/quick-start

#########################################################################

Item 3.A.7 above, you may want to just change the Make file to install that unbound.conf file directly into /usr/local/etc/unbound/unbound.conf