DHCP DNS integration still does not work

jetberrocal · 04-21-2010, 10:51 AM

This are the logs of the named service when is starting:

Apr 21 11:07:16 engarde named: named startup failed
Apr 21 11:11:20 engarde named[5340]: starting BIND 9.4.3 -4 -c /var/named/named.conf -t /var/chroot/named -u named
Apr 21 11:11:20 engarde named[5340]: found 1 CPU, using 1 worker thread
Apr 21 11:11:20 engarde named[5340]: using up to 4096 sockets
Apr 21 11:11:20 engarde named[5340]: loading configuration from '/var/named/named.conf'
Apr 21 11:11:20 engarde named[5340]: max open files (1024) is smaller than max sockets (4096)
Apr 21 11:11:20 engarde named[5340]: using default UDP/IPv4 port range: [1024, 65535]
Apr 21 11:11:20 engarde named[5340]: using default UDP/IPv6 port range: [1024, 65535]
Apr 21 11:11:20 engarde named[5340]: no IPv6 interfaces found
Apr 21 11:11:20 engarde named[5340]: listening on IPv4 interface eth2, 192.168.1.75#53
Apr 21 11:11:20 engarde named[5340]: zone 'engnet.com.' allows updates by IP address, which is insecure
Apr 21 11:11:20 engarde named[5340]: zone 'engnet.com.' allows updates by IP address, which is insecure
Apr 21 11:11:20 engarde named[5340]: zone '1.168.192.in-addr.arpa.' allows updates by IP address, which is insecure
Apr 21 11:11:20 engarde named[5340]: zone '1.168.192.in-addr.arpa.' allows updates by IP address, which is insecure
Apr 21 11:11:20 engarde named[5340]: command channel listening on 127.0.0.1#953
Apr 21 11:11:20 engarde named[5340]: could not open entropy source /dev/urandom: file not found
Apr 21 11:11:20 engarde named[5340]: using pre-chroot entropy source /dev/urandom
Apr 21 11:11:20 engarde named[5340]: the working directory is not writable
Apr 21 11:11:20 engarde named[5340]: /var/named/named.conf:47: unknown logging category 'cname' ignored
Apr 21 11:11:20 engarde named[5340]: /var/named/named.conf:67: unknown logging category 'os' ignored
Apr 21 11:11:20 engarde named[5340]: /var/named/named.conf:94: unknown logging category 'ncache' ignored
Apr 21 11:11:20 engarde named[5340]: /var/named/named.conf:103: unknown logging category 'panic' ignored
Apr 21 11:11:20 engarde named[5340]: /var/named/named.conf:112: unknown logging category 'statistics' ignored
Apr 21 11:11:20 engarde named[5340]: /var/named/named.conf:117: unknown logging category 'response-checks' ignored
Apr 21 11:11:20 engarde named[5340]: zone 0.0.127.in-addr.arpa/IN: loaded serial 1
Apr 21 11:11:20 engarde named[5340]: zone 1.168.192.in-addr.arpa/IN: loaded serial 2010030399
Apr 21 11:11:20 engarde named[5340]: zone engnet.com/IN: loaded serial 2010030205
Apr 21 11:11:20 engarde named[5340]: zone localhost/IN: loaded serial 1
Apr 21 11:11:20 engarde named[5340]: running
Apr 21 11:11:20 engarde named: named startup succeeded

Blue_Ice · 04-21-2010, 03:41 PM

Well, below I posted my dns server configuration. A very basic one that works though. I use it on my own home server.
The only difference I can see is that in your zone declaration you is a dot to finalize the name. However I am not sure if that causes the problem.
Anyway, I use this config to build up more complex configurations. This way I know that the basics work and the added configurations cause the problem.

In dhcpd.conf, I didn't put the secret of the key between quotes. Maybe the quotes are part of the key now, which probably doesn't match to the key in rndc.key.

Code:

key dhcpupdate {
    algorithm hmac-md5;
    secret <secret>;
};

options {
    directory "/etc/named";
    listen-on port 53 { 
        10.200.55.10;
        127.0.0.1;
    };
    recursion yes;
    allow-recursion {
        127.0.0.1;
        10.0.0.0/8;
    };
    allow-query {
        127.0.0.1;
        10.0.0.0/8;
    };
};

zone "hulshoff.home" {
    type master;
    file "/etc/named/hulshoff.home.fwd.zone";
    allow-update { 
        key dhcpupdate; 
        localhost; 
    };
};

zone "10.in-addr.arpa" {
    type master;
    file "/etc/named/hulshoff.home.rev.zone";
    allow-update {
        key dhcpupdate;
        localhost;
    };
};

zone "localhost" {
    type master;
    file "/etc/named/localhost.fwd.zone";
    allow-update {
        none;
    };
};

zone "0.0.127.in-addr.arpa" {
    type master;
    file "/etc/named/localhost.rev.zone";
    allow-update {
        none;
    };
};

zone "." {
    type hint;
    file "/etc/named/db.cache";
};

jetberrocal · 04-22-2010, 09:15 AM

Quote:

Originally Posted by Blue_Ice

Well, below I posted my dns server configuration. A very basic one that works though. I use it on my own home server.
The only difference I can see is that in your zone declaration you is a dot to finalize the name. However I am not sure if that causes the problem.
Anyway, I use this config to build up more complex configurations. This way I know that the basics work and the added configurations cause the problem.

In dhcpd.conf, I didn't put the secret of the key between quotes. Maybe the quotes are part of the key now, which probably doesn't match to the key in rndc.key.

This is my new dhcpd.conf:

Code:

authoritative;
ddns-domainname "engnet.com.";
ddns-rev-domainname "in-addr.arpa.";
ddns-update-style interim;
ddns-updates on;
ignore client-updates;
allow unknown-clients;

key "dhcpupdate" {
        algorithm hmac-md5;
        secret "7TzaEvXOjypx7Q+ee8dhMyJWthoW4/rNPiBQ8+eHQxz8P15e/DYh0k6pV3Slz6k3A++rzWMnpAbLGIocStW+6w==";
};

zone engnet.com. {
primary 127.0.0.1;
key "dhcpupdate";
}

subnet 192.168.1.0 netmask 255.255.255.0 {
### RangeID 1
   option routers                  192.168.1.75;
   option subnet-mask              255.255.255.0;

   option domain-name              "engnet.com";
   option domain-name-servers      192.168.1.75;

   range 192.168.1.100 192.168.1.250;

   default-lease-time 43200;
   max-lease-time 86400;

   zone 1.168.192.in-addr.arpa. {
        primary 127.0.0.1;
        key "dhcpupdate";
   }

}

Should I change "dhcpupdate" to dhcpupdate or you mean change secret "value" to secret value?

This is my named.conf:

Code:

key dhcpupdate {
        algorithm "hmac-md5";
        secret "7TzaEvXOjypx7Q+ee8dhMyJWthoW4/rNPiBQ8+eHQxz8P15e/DYh0k6pV3Slz6k3A++rzWMnpAbLGIocStW+6w==";
};

options {
        # This was added for security purposes under BIND 9.
        version "None of your business.";


        directory "/var/named";
        dump-file "/var/tmp/named_dump.db";             // _PATH_DUMPFILE
        pid-file "/var/run/named.pid";                  // _PATH_PIDFILE
        statistics-file "/var/tmp/named.stats";         // _PATH_STATS
        memstatistics-file "/var/tmp/named.memstats";   // _PATH_MEMSTATS

        check-names master warn;
        check-names slave warn;
        check-names response warn;
        notify yes;
        datasize 20M;
        allow-transfer {
                any;
        };
        allow-query {
                any;
        };
        forward only;
        listen-on {
                192.168.1.75;
        };
        forwarders {
                192.168.0.80;
                192.168.0.20;
                192.168.0.1;
        };
};


logging {
        category lame-servers { null; };
        category cname { null; };

        // Configure default level of application debugging
        channel named_debug {
                file "/var/log/named.debug.log" versions 3 size 10m;
                severity debug 4;
                print-time yes;
                print-category yes;
        };
        category default {
                default_syslog; default_debug; named_debug;
        };

        // Send operating system problem messages to named.debug log
        channel os_info {
                severity debug;
                file "/var/log/named.os.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category os { os_info; default_syslog; named_debug; };

        // Record all queries to the box for now
        // channel query_info {
              // severity info;
              // file "/var/log/named.query.log" versions 3 size 5m;
              // print-time yes;
              // print-category yes;
         // };
         // category queries { query_info; named_debug; };

        // Print all security-related messages to named.security file
        channel security_info {
                severity debug;
                file "/var/log/named.security.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category security { security_info; default_syslog; default_debug; };

        // Print negative caching messages to named.cache.log
        channel cache_info {
                severity debug;
                file "/var/log/named.cache.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category ncache { cache_info; default_syslog; default_debug; };

        // Print any fatal problems to named.fatal.log
        channel panic_info {
                severity debug;
                file "/var/log/named.panic.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category panic { panic_info; default_syslog; default_debug; };

        // Print statistics information to named.stats.log
        channel stats_info {
                severity debug;
                file "/var/log/named.stats.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category statistics { stats_info; };

        channel response_info {
                null;
        };
        category response-checks { response_info; };

};

zone "localhost" {
        type master;
        file "master/localhost";
        check-names fail;
        allow-update { none; };
        allow-transfer { any; };
};

zone "0.0.127.in-addr.arpa" {
        type master;
        file "master/127.0.0";
        allow-update { none; };
        allow-transfer { any; };
};

zone "." {
        type hint;
        file "named.root";
};


zone "engnet.com." {
        type master;
        file "master/db.engnet.com.";
        allow-query {
                any;
        };
        allow-transfer {
                any;
        };
        allow-update {
                key dhcpupdate;
        };
};

zone "1.168.192.in-addr.arpa." {
        type master;
        file "master/db.1.168.192.in-addr.arpa.";
        allow-query {
                any;
        };
        allow-transfer {
                any;
        };
        allow-update {
                key dhcpupdate;
        };
};

Again, is this the correct "" syntax?

Jose

Blue_Ice · 04-22-2010, 09:47 AM

I meant secret "value" to secret value...

jetberrocal · 04-22-2010, 10:18 AM

Code:

key "dhcpupdate" {
        algorithm hmac-md5;
        secret 7TzaEvXOjypx7Q+ee8dhMyJWthoW4/rNPiBQ8+eHQxz8P15e/DYh0k6pV3Slz6k3A++rzWMnpAbLGIocStW+6w==;
};

named.conf as previous post

Tried with and without the quotes.

Blue_Ice · 04-22-2010, 10:25 AM

And dhcpupdate without quotes...

By the way dhcpupdate is just a name.

jetberrocal · 04-22-2010, 10:36 AM

This is without quotes in dhcpd.conf

Code:

authoritative;
ddns-domainname "engnet.com.";
ddns-rev-domainname "in-addr.arpa.";
ddns-update-style interim;
ddns-updates on;
ignore client-updates;
allow unknown-clients;

key dhcpupdate {
        algorithm hmac-md5;
        secret 7TzaEvXOjypx7Q+ee8dhMyJWthoW4/rNPiBQ8+eHQxz8P15e/DYh0k6pV3Slz6k3A++rzWMnpAbLGIocStW+6w==;
};

zone engnet.com {
primary 127.0.0.1;
key dhcpupdate;
}

subnet 192.168.1.0 netmask 255.255.255.0 {
### RangeID 1
   option routers                  192.168.1.75;
   option subnet-mask              255.255.255.0;

   option domain-name              "engnet.com";
   option domain-name-servers      192.168.1.75;

   range 192.168.1.100 192.168.1.250;

   default-lease-time 43200;
   max-lease-time 86400;

   zone 1.168.192.in-addr.arpa {
        primary 127.0.0.1;
        key dhcpupdate;
   }

}

Same named.conf

Still connection refused.

jetberrocal · 04-22-2010, 10:46 AM

New named.conf without quotes

Code:

key dhcpupdate {
        algorithm hmac-md5;
        secret "7TzaEvXOjypx7Q+ee8dhMyJWthoW4/rNPiBQ8+eHQxz8P15e/DYh0k6pV3Slz6k3A++rzWMnpAbLGIocStW+6w==";
};

options {
        # This was added for security purposes under BIND 9.
        version "None of your business.";


        directory "/var/named";
        dump-file "/var/tmp/named_dump.db";             // _PATH_DUMPFILE
        pid-file "/var/run/named.pid";                  // _PATH_PIDFILE
        statistics-file "/var/tmp/named.stats";         // _PATH_STATS
        memstatistics-file "/var/tmp/named.memstats";   // _PATH_MEMSTATS

        check-names master warn;
        check-names slave warn;
        check-names response warn;
        notify yes;
        datasize 20M;
        allow-transfer {
                any;
        };
        allow-query {
                any;
        };
        forward only;
        listen-on {
                192.168.1.75;
        };
        forwarders {
                192.168.0.80;
                192.168.0.20;
                192.168.0.1;
        };
};


logging {
        category lame-servers { null; };
        category cname { null; };

        // Configure default level of application debugging
        channel named_debug {
                file "/var/log/named.debug.log" versions 3 size 10m;
                severity debug 4;
                print-time yes;
                print-category yes;
        };
        category default {
                default_syslog; default_debug; named_debug;
        };

        // Send operating system problem messages to named.debug log
        channel os_info {
                severity debug;
                file "/var/log/named.os.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category os { os_info; default_syslog; named_debug; };

        // Record all queries to the box for now
        // channel query_info {
              // severity info;
              // file "/var/log/named.query.log" versions 3 size 5m;
              // print-time yes;
              // print-category yes;
         // };
         // category queries { query_info; named_debug; };

        // Print all security-related messages to named.security file
        channel security_info {
                severity debug;
                file "/var/log/named.security.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category security { security_info; default_syslog; default_debug; };

        // Print negative caching messages to named.cache.log
        channel cache_info {
                severity debug;
                file "/var/log/named.cache.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category ncache { cache_info; default_syslog; default_debug; };

        // Print any fatal problems to named.fatal.log
        channel panic_info {
                severity debug;
                file "/var/log/named.panic.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category panic { panic_info; default_syslog; default_debug; };

        // Print statistics information to named.stats.log
        channel stats_info {
                severity debug;
                file "/var/log/named.stats.log" versions 3 size 5m;
                print-time yes;
                print-category yes;
        };
        category statistics { stats_info; };

        channel response_info {
                null;
        };
        category response-checks { response_info; };

};

zone "localhost" {
        type master;
        file "master/localhost";
        check-names fail;
        allow-update { none; };
        allow-transfer { any; };
};

zone "0.0.127.in-addr.arpa" {
        type master;
        file "master/127.0.0";
        allow-update { none; };
        allow-transfer { any; };
};

zone "." {
        type hint;
        file "named.root";
};


zone "engnet.com" {
        type master;
        file "master/db.engnet.com.";
        allow-query {
                any;
        };
        allow-transfer {
                any;
        };
        allow-update {
                key dhcpupdate;
        };
};

zone "1.168.192.in-addr.arpa" {
        type master;
        file "master/db.1.168.192.in-addr.arpa.";
        allow-query {
                any;
        };
        allow-transfer {
                any;
        };
        allow-update {
                key dhcpupdate;
        };
};

Still connection refused

jetberrocal · 04-22-2010, 10:56 AM

Just want to clarify that the DHCP service runs on the same computer as the DNS service

Jose

jetberrocal · 04-22-2010, 11:00 AM

Another clarification.
Services versions:
DHCP 4.0.0
BIND 9.4.3

Blue_Ice · 04-22-2010, 11:06 AM

The same goes for me.

I don't know what the issue can be. I must be overlooking something in your config.
Your computers get a dhcp lease and your able to lookup systems with a static ipaddress (if you have defined them in your zone files) with nslookup?

jetberrocal · 04-22-2010, 11:31 AM

Quote:

Originally Posted by Blue_Ice

The same goes for me.

I don't know what the issue can be. I must be overlooking something in your config.
Your computers get a dhcp lease and your able to lookup systems with a static ipaddress (if you have defined them in your zone files) with nslookup?

This is a small system, there is only one static ip computer, the DHCP/DNS server.

All the others get their IP assign by DHCP and they can ping each other by IP.

This is an "ipconfig /all" at the client:

Code:


Windows IP Configuration


        Host Name . . . . . . . . . . . . : service2
        Primary Dns Suffix  . . . . . . . : 
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : engnet.com


Ethernet adapter DeltaV Primary:


        Connection-specific DNS Suffix  . : 
        Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controller
        Physical Address. . . . . . . . . : 00-1A-A0-1B-9C-DE
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 10.4.0.6
        Subnet Mask . . . . . . . . . . . : 255.254.0.0
        Default Gateway . . . . . . . . . : 
        DNS Servers . . . . . . . . . . . : 10.4.0.6

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : engnet.com
        Description . . . . . . . . . . . : 3Com EtherLink XL 10/100 PCI For Complete PC Management NIC (3C905C-TX)
        Physical Address. . . . . . . . . : 00-04-75-D3-9F-27
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.152
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.75
        DHCP Server . . . . . . . . . . . : 192.168.1.75
        DNS Servers . . . . . . . . . . . : 192.168.1.75
        Lease Obtained. . . . . . . . . . : Wednesday, May 23, 2007 11:44:53 AM
        Lease Expires . . . . . . . . . . : Wednesday, May 23, 2007 11:44:53 PM

This is a nslookup run at the client: "nslookup engarde"

Code:

*** Can't find server name for address 192.168.1.75: Non-existent domain
*** Can't find server name for address 10.4.0.6: No response from server
*** Default servers are not available
Server:  UnKnown
Address:  192.168.1.75

Name:    engarde.engnet.com
Address:  192.168.1.75

jetberrocal · 04-22-2010, 11:34 AM

To clarify:

I can ping engarde.engnet.com and engarde by name.

Before all this changes I could ping by name internet addresses, but now I can't.

Jose

Blue_Ice · 04-22-2010, 02:07 PM

Quote:

Originally Posted by jetberrocal

To clarify:

I can ping engarde.engnet.com and engarde by name.

Before all this changes I could ping by name internet addresses, but now I can't.

Jose

This probably has to do with resolv.conf. You have to add your ISP's nameservers. Your DNS server needs to know where the DNS servers of the internet are.

The message regarding to non-existent domain could be, because the zone files are not correct. Can you post the zone files of the A and PTR records?

jetberrocal · 04-23-2010, 10:45 AM

Quote:

Originally Posted by Blue_Ice

This probably has to do with resolv.conf. You have to add your ISP's nameservers. Your DNS server needs to know where the DNS servers of the internet are.

The message regarding to non-existent domain could be, because the zone files are not correct. Can you post the zone files of the A and PTR records?

[root@engarde master]# cat db.engnet.com.

Code:

$ORIGIN .
$TTL 86400      ; 1 day
engnet.com              IN SOA  engarde.engnet.com. administrator.conecodepr.com. (
                                2010030205 ; serial
                                43200      ; refresh (12 hours)
                                3600       ; retry (1 hour)
                                3600       ; expire (1 hour)
                                604800     ; minimum (1 week)
                                )
                        NS      engarde.engnet.com.
$ORIGIN engnet.com.
engarde                 A       192.168.1.75
$TTL 1200       ; 20 minutes
proplus-demo            A       192.168.1.155

[root@engarde master]# cat /etc/resolv.conf

Code:

search engnet.com
nameserver 192.168.1.75

Since I have forwarders that resolve internet addresses:

Code:

options {
        # This was added for security purposes under BIND 9.
        version "None of your business.";


        directory "/var/named";
        dump-file "/var/tmp/named_dump.db";             // _PATH_DUMPFILE
        pid-file "/var/run/named.pid";                  // _PATH_PIDFILE
        statistics-file "/var/tmp/named.stats";         // _PATH_STATS
        memstatistics-file "/var/tmp/named.memstats";   // _PATH_MEMSTATS

        check-names master warn;
        check-names slave warn;
        check-names response warn;
        notify yes;
        datasize 20M;
        allow-transfer {
                any;
        };
        allow-query {
                any;
        };
        forward only;
        listen-on {
                192.168.1.75;
        };
        forwarders {
                192.168.0.80;
                192.168.0.20;
                192.168.0.1;
        };
};

If I add to the named.conf the controls directive:

Code:

controls {
        inet 127.0.0.1 allow { localhost; } keys { rndc-key; };
};

Resolves internet addresses intermittently