Ladies & Gents,

I am having an issue with my bind install. I discovered today in the process of changing the user to a non-privileged user that I am getting this error

[CODE] : /etc/bind/named.conf.local:14: couldn't install keys for command channel 127.0.0.1#953: permission denied
: /etc/bind/named.conf.local:14: couldn't add command channel 127.0.0.1#953: permission denied
[\CODE]

In named.conf.local I have
[CODE]
controls {
inet 127.0.0.1 allow { localhost; };
};
[\CODE]

What file is it trying to write to?

What I have been trying to do is 1. stop bind from responding to requests from the internet and I seam to have had success.

2. run bind as a non-privileged user; partial success

3. put bind in chroot jail, yet to do.

I have added some statements to /etc/bind/named.conf.options
They are
[CODE]pid-file "/var/run/named/named.pid";
allow-query { 192.168.7/24; };
allow-transfer { none; };
allow-recursion { 192.168.7/24; };
listen-on { 192.168.7.1; };
forward only;
[\CODE]

In /etc/default/bind9 I have changed the user from 'bind' to 'named'

I created user and group 'named' and set permits on /var/run/named/named.pid

I am also getting a permission error for the rndc.key but have not changed permissions or owner.

I was trying to be careful not to break it but it seams that I did. I had name resolution for my local network working but something in the process above has broken it.

From one of the posts I read I got the impression that it was no longer necessary to run bind as a non-privileged user. Is that true? I think it was something I did when I started that part of the process that broke it.

This machine is to be my primary firewall/dhcp/dns so...

What did I do wrong?

Thanks for any insight you can give me.

I have reverted to the "bind" user that debian creats on install and the errors have gone away. But my lookup is still not working.

Update:

I backed up and removed all my changes and resolution started working again. Two different things seam to be causing it. First in changing things I enabled the RFC1918 zones ( include "/etc/bind/zones.rfc1918"; ) and checked the file and disabled the zone for my ip range, or so I thought.

The second thing is the options I added to restrict access to bind from the internet. I have not gone through them one at a time to see if I can isolate which one/s are causing the problem. They are:
allow-query { 192.168.7/24; };
allow-transfer { none; };
allow-recursion { 192.168.7/24; };
listen-on { 192.168.7.1; };
forward only;

Looking at these ip settings they don't seam right. Should they not be something like 192.168.7.0/24 ?

Thanks

More info;

The first entry breaks it. allow-query { 192.168.7.0/24; };

Why?

Thanks