Currently, remote control forces users to fiddle with certificates to make transport and authentication secure even if it is listening on localhost. Proposal is to utilize Unix domain sockets as an alternative to TCP sockets.

Benefits:

• No fiddling with certificates
• No open TCP socket for all users on the system
• UDS can be protected by OS/FS means, e.g., unbound:wheel and everyone in wheel can communicate with the process
• and likely others

Note: UDS is now also available on Windows as well.

Default path could be /var/run/unbound-remote-control.sock. Ideally configured in a way that it does not need to be passed constantly to unbound-control(8) (read from config file, like -s).

New option could be -u /path/to/socket.