rc.bind stop gives problem

matters · 10-23-2008, 09:39 AM

This is what i get :

Code:

root@parade:/var/named/chroot/etc# /etc/rc.d/rc.bind restart
Stopping BIND:  /usr/sbin/rndc stop
rndc: connection to remote host closed
This may indicate that
* the remote server is using an older version of the command protocol,
* this host is not authorized to connect,
* the clocks are not syncronized, or
* the key is invalid.
Using killall named on additional BIND processes...
Starting BIND:  /usr/sbin/named -u named -t /var/named/chroot -c /etc/named.conf
root@parade:/var/named/chroot/etc# netstat -ntlp |grep 953
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      3460/named
root@parade:/var/named/chroot/etc# /etc/rc.d/rc.bind stop
Stopping BIND:  /usr/sbin/rndc stop
rndc: connection to remote host closed
This may indicate that
* the remote server is using an older version of the command protocol,
* this host is not authorized to connect,
* the clocks are not syncronized, or
* the key is invalid.
Using killall named on additional BIND processes...
root@parade:/var/named/chroot/etc# netstat -ntlp |grep 953
root@parade:/var/named/chroot/etc#

this is what rc.bind restart gives

Code:

root@parade:/var/named/chroot/etc# /etc/rc.d/rc.bind restart
Stopping BIND:  /usr/sbin/rndc stop
rndc: connect failed: 127.0.0.1#953: connection refused
Starting BIND:  /usr/sbin/named -u named -t /var/named/chroot -c /etc/named.conf
root@parade:/var/named/chroot/etc# netstat -ntlp |grep 953
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      3496/named
root@parade:/var/named/chroot/etc#

As u can see when i say stop ports 953 and 53 is no longer listening as it should and on restart they are listening again.
What might cause error messages?

Thanks!

matters · 10-23-2008, 11:31 AM

this is what fixed the problem

3 steps to solve our problem

1. we create a new key using below ONE line bash command
first
cd /etc

now create the new nameserver key rndc-key which by default is saved to the file named rndc.key THIS folder.

rndc-confgen -b 512 | grep -m 1 "secret" | cut -d '"' -f 2

the output in your shell will be something like below BUT longer !

KgX0x/KFDE9Ylzq7JAbGs==

at the same time the new rndc.key is generated -- check for time stamp using
ls -la rndc.key for verification

2. step

in your
/etc/named.conf
you should have two entries OUTSIDE your "options" as below - one for

controls

another one for

key "rndc-key"

hence here below the full content you either have or need to add to your named.conf

------------- quote

controls {
inet 127.0.0.1 allow { localhost; } keys { rndc-key; };
};

key "rndc-key" {
algorithm hmac-md5;
secret "here BETWEEN the 2 double-quotes - you copy and paste your initially generated key as shown in your shell - NOT the content of your rndc.key file !!";
};

------------- unquote

3. step

now we look at your

rndc.conf file

which should read

------- quote

# Start of rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "here again you copy and paste the shell output of your generated rncd-key";
};

options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};

------- unquote

another attempt to restart your name-server bind9 should be successful

but first we want to TEST out named.conf configuration using the tool available from the bind9 package.

in your shell enter

named-checkconf

the output is self-explaining and detailed if you have any syntax error

rcnamed restart
Shutting down name server BIND done
Starting name server BIND done

in case anyone else occurs