Bind9 problem

WiWa · 06-05-2004, 09:12 AM

I just tried to configure BIND. I've done this many times before, but now sth doesn't work. The mistakes below should be easy to fix, but I just don't see the clue.

In my /etc/named.conf file, you will find:

options {
directory "/var/named";
pid-file "named.pid";
forwarders {
10.0.0.2;
};

When I do: /etc/init.d/named restart, it gives a fail. When I look in the /var/log/messages, I can see:

Jun 5 15:54:10 thorgal1 named[2720]: starting BIND 9.2.2 -t /var/lib/named -u named
Jun 5 15:54:10 thorgal1 named[2720]: using 1 CPU
Jun 5 15:54:10 thorgal1 named[2722]: loading configuration from '/etc/named.conf'
Jun 5 15:54:10 thorgal1 named[2722]: /etc/named.conf:2: change directory to '/var/named' failed: file not found
Jun 5 15:54:10 thorgal1 named[2722]: /etc/named.conf:2: parsing failed
Jun 5 15:54:10 thorgal1 named[2722]: loading configuration: file not found
Jun 5 15:54:10 thorgal1 named[2722]: exiting (due to fatal error)

When I googled, I found that I should do:

options {
directory "/";
pid-file "named.pid";
forwarders {
10.0.0.2;
};

When I do this and I restart named, then it gives the following error:

Jun 5 15:59:26 thorgal1 named[2835]: starting BIND 9.2.2 -t /var/lib/named -u named
Jun 5 15:59:26 thorgal1 named[2835]: using 1 CPU
Jun 5 15:59:26 thorgal1 named[2837]: loading configuration from '/etc/named.conf'
Jun 5 15:59:26 thorgal1 named[2837]: listening on IPv4 interface lo, 127.0.0.1#53
Jun 5 15:59:26 thorgal1 named[2837]: listening on IPv4 interface eth0, 10.0.0.13#53
Jun 5 15:59:26 thorgal1 named[2837]: )could not configure root hints from 'named.ca': file not found
Jun 5 15:59:26 thorgal1 named[2837]: loading configuration: file not found
Jun 5 15:59:26 thorgal1 named[2837]: exiting (due to fatal error)

However, this file is in my /var/named directory/

Any idea on what is wrong here...

For completeness, I attach my named.conf file:

options {
directory "/var/named";
pid-file "named.pid";
forwarders {
10.0.0.2;
};

/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
query-source port 53;
forward only;
recursion yes;
//check-names response warn;
//check-names master warn;
};

//
// a caching only nameserver config
//
controls {
inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
zone "." IN {
type hint;
file "named.ca";
};

include "/etc/rndc.key";

zone "wauters-mannaert.be" {
type master;
file "/var/named/named.hosts";
};

zone "localhost" {
type master;
file "/var/named/localhost.zone";
};

zone "0.0.127.in-addr.arpa" {
type master;
file "/var/named/local.rev";
};

zone "0.0.10.in-addr.arpa" {
type master;
file "/var/named/named.rev";
};

logging {
channel logDNS {
file "/var/log/bind/logDNS.log";
severity info;
print-severity yes;
};
};

chort · 06-05-2004, 05:07 PM

What distro are you trying to set this up on, and do you know if it's trying to chroot named? You should certainly not be making named live in /, since that would give it access to the entire system--something you DON'T want to do with BIND's insecurity record.

It seems that it may be trying to chroot itself and not all the expected files are in the chroot'd environment.

Pete M · 06-05-2004, 06:00 PM

WiWa

Quote:

Redhat BIND runs normally as the named process as the unprivileged named user.

Fedora takes the added precaution of using Linux's chroot feature to not only run named as user named but also to limit the files named can see. In Fedora, named is fooled into thinking that the directory /var/named/chroot is actually the root or "/" directory. Therefore named files normally found in the /etc directory are found in /var/named/chroot/etc directory instead, and those you'd expect to find in /var/named are actually located in /var/named/chroot/var/named.

Fedora BIND adds to the confusion by correctly installing the files in their non chroot locations, but they are never read.

Note: With Fedora, make copies of your regular and chroot files. The chroot version of named.conf is empty, cut and paste the contents of the /etc version into this file, it is a little safer than copying as the file permissions and ownerships are different too.

Regards

Pete

WiWa · 06-06-2004, 05:27 AM

Thanks. The distro I'm trying to set this up is SUSE 9.0. I did (as I had to do with Fedora Core)
"chown named:named /var/named". Could that be causing these probs?

I know in Fedora it's trying to chroot, although I never understood the ins and outs of chroot. In Suse, I had to create the var/named directory myself, so no chroot available.