1Frequently Asked Questions about BIND 9 2 3Copyright � 2004-2010, 2013, 2014 Internet Systems Consortium, Inc. 4("ISC") 5 6Copyright � 2000-2003 Internet Software Consortium. 7 8----------------------------------------------------------------------- 9 101. Compilation and Installation Questions 11 12Q: I'm trying to compile BIND 9, and "make" is failing due to files not 13 being found. Why? 14 15A: Using a parallel or distributed "make" to build BIND 9 is not 16 supported, and doesn't work. If you are using one of these, use normal 17 make or gmake instead. 18 19Q: Isn't "make install" supposed to generate a default named.conf? 20 21A: Short Answer: No. 22 23 Long Answer: There really isn't a default configuration which fits any 24 site perfectly. There are lots of decisions that need to be made and 25 there is no consensus on what the defaults should be. For example 26 FreeBSD uses /etc/namedb as the location where the configuration files 27 for named are stored. Others use /var/named. 28 29 What addresses to listen on? For a laptop on the move a lot you may 30 only want to listen on the loop back interfaces. 31 32 To whom do you offer recursive service? Is there a firewall to 33 consider? If so, is it stateless or stateful? Are you directly on the 34 Internet? Are you on a private network? Are you on a NAT'd network? The 35 answers to all these questions change how you configure even a caching 36 name server. 37 382. Configuration and Setup Questions 39 40Q: Why does named log the warning message "no TTL specified - using SOA 41 MINTTL instead"? 42 43A: Your zone file is illegal according to RFC1035. It must either have a 44 line like: 45 46 $TTL 86400 47 48 at the beginning, or the first record in it must have a TTL field, like 49 the "84600" in this example: 50 51 example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 ) 52 53Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master 54 file bar: ran out of space"? 55 56A: This is often caused by TXT records with missing close quotes. Check 57 that all TXT records containing quoted strings have both open and close 58 quotes. 59 60Q: How do I restrict people from looking up the server version? 61 62A: Put a "version" option containing something other than the real version 63 in the "options" section of named.conf. Note doing this will not 64 prevent attacks and may impede people trying to diagnose problems with 65 your server. Also it is possible to "fingerprint" nameservers to 66 determine their version. 67 68Q: How do I restrict only remote users from looking up the server version? 69 70A: The following view statement will intercept lookups as the internal 71 view that holds the version information will be matched last. The 72 caveats of the previous answer still apply, of course. 73 74 view "chaos" chaos { 75 match-clients { <those to be refused>; }; 76 allow-query { none; }; 77 zone "." { 78 type hint; 79 file "/dev/null"; // or any empty file 80 }; 81 }; 82 83Q: What do "no source of entropy found" or "could not open entropy source 84 foo" mean? 85 86A: The server requires a source of entropy to perform certain operations, 87 mostly DNSSEC related. These messages indicate that you have no source 88 of entropy. On systems with /dev/random or an equivalent, it is used by 89 default. A source of entropy can also be defined using the 90 random-device option in named.conf. 91 92Q: I'm trying to use TSIG to authenticate dynamic updates or zone 93 transfers. I'm sure I have the keys set up correctly, but the server is 94 rejecting the TSIG. Why? 95 96A: This may be a clock skew problem. Check that the the clocks on the 97 client and server are properly synchronised (e.g., using ntp). 98 99Q: I see a log message like the following. Why? 100 101 couldn't open pid file '/var/run/named.pid': Permission denied 102 103A: You are most likely running named as a non-root user, and that user 104 does not have permission to write in /var/run. The common ways of 105 fixing this are to create a /var/run/named directory owned by the named 106 user and set pid-file to "/var/run/named/named.pid", or set pid-file to 107 "named.pid", which will put the file in the directory specified by the 108 directory option (which, in this case, must be writable by the user 109 named is running as). 110 111Q: I can query the nameserver from the nameserver but not from other 112 machines. Why? 113 114A: This is usually the result of the firewall configuration stopping the 115 queries and / or the replies. 116 117Q: How can I make a server a slave for both an internal and an external 118 view at the same time? When I tried, both views on the slave were 119 transferred from the same view on the master. 120 121A: You will need to give the master and slave multiple IP addresses and 122 use those to make sure you reach the correct view on the other machine. 123 124 Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias) 125 internal: 126 match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; }; 127 notify-source 10.0.1.1; 128 transfer-source 10.0.1.1; 129 query-source address 10.0.1.1; 130 external: 131 match-clients { any; }; 132 recursion no; // don't offer recursion to the world 133 notify-source 10.0.1.2; 134 transfer-source 10.0.1.2; 135 query-source address 10.0.1.2; 136 137 Slave: 10.0.1.3 (internal), 10.0.1.4 (external, IP alias) 138 internal: 139 match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; }; 140 notify-source 10.0.1.3; 141 transfer-source 10.0.1.3; 142 query-source address 10.0.1.3; 143 external: 144 match-clients { any; }; 145 recursion no; // don't offer recursion to the world 146 notify-source 10.0.1.4; 147 transfer-source 10.0.1.4; 148 query-source address 10.0.1.4; 149 150 You put the external address on the alias so that all the other dns 151 clients on these boxes see the internal view by default. 152 153A: BIND 9.3 and later: Use TSIG to select the appropriate view. 154 155 Master 10.0.1.1: 156 key "external" { 157 algorithm hmac-sha256; 158 secret "xxxxxxxxxxxxxxxxxxxxxxxx"; 159 }; 160 view "internal" { 161 match-clients { !key external; // reject message ment for the 162 // external view. 163 10.0.1/24; }; // accept from these addresses. 164 ... 165 }; 166 view "external" { 167 match-clients { key external; any; }; 168 server 10.0.1.2 { keys external; }; // tag messages from the 169 // external view to the 170 // other servers for the 171 // view. 172 recursion no; 173 ... 174 }; 175 176 Slave 10.0.1.2: 177 key "external" { 178 algorithm hmac-sha256; 179 secret "xxxxxxxxxxxxxxxxxxxxxxxx"; 180 }; 181 view "internal" { 182 match-clients { !key external; 10.0.1/24; }; 183 ... 184 }; 185 view "external" { 186 match-clients { key external; any; }; 187 server 10.0.1.1 { keys external; }; 188 recursion no; 189 ... 190 }; 191 192Q: I get error messages like "multiple RRs of singleton type" and "CNAME 193 and other data" when transferring a zone. What does this mean? 194 195A: These indicate a malformed master zone. You can identify the exact 196 records involved by transferring the zone using dig then running 197 named-checkzone on it. 198 199 dig axfr example.com @master-server > tmp 200 named-checkzone example.com tmp 201 202 A CNAME record cannot exist with the same name as another record except 203 for the DNSSEC records which prove its existence (NSEC). 204 205 RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other 206 data should be present; this ensures that the data for a canonical name 207 and its aliases cannot be different. This rule also insures that a 208 cached CNAME can be used without checking with an authoritative server 209 for other RR types." 210 211Q: I get error messages like "named.conf:99: unexpected end of input" 212 where 99 is the last line of named.conf. 213 214A: There are unbalanced quotes in named.conf. 215 216A: Some text editors (notepad and wordpad) fail to put a line title 217 indication (e.g. CR/LF) on the last line of a text file. This can be 218 fixed by "adding" a blank line to the end of the file. Named expects to 219 see EOF immediately after EOL and treats text files where this is not 220 met as truncated. 221 222Q: How do I share a dynamic zone between multiple views? 223 224A: You choose one view to be master and the second a slave and transfer 225 the zone between views. 226 227 Master 10.0.1.1: 228 key "external" { 229 algorithm hmac-sha256; 230 secret "xxxxxxxxxxxxxxxxxxxxxxxx"; 231 }; 232 233 key "mykey" { 234 algorithm hmac-sha256; 235 secret "yyyyyyyyyyyyyyyyyyyyyyyy"; 236 }; 237 238 view "internal" { 239 match-clients { !key external; 10.0.1/24; }; 240 server 10.0.1.1 { 241 /* Deliver notify messages to external view. */ 242 keys { external; }; 243 }; 244 zone "example.com" { 245 type master; 246 file "internal/example.db"; 247 allow-update { key mykey; }; 248 also-notify { 10.0.1.1; }; 249 }; 250 }; 251 252 view "external" { 253 match-clients { key external; any; }; 254 zone "example.com" { 255 type slave; 256 file "external/example.db"; 257 masters { 10.0.1.1; }; 258 transfer-source 10.0.1.1; 259 // allow-update-forwarding { any; }; 260 // allow-notify { ... }; 261 }; 262 }; 263 264Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading 265 master file primaries/wireless.ietf56.ietf.org: no owner". 266 267A: This error is produced when a line in the master file contains leading 268 white space (tab/space) but there is no current record owner name to 269 inherit the name from. Usually this is the result of putting white 270 space before a comment, forgetting the "@" for the SOA record, or 271 indenting the master file. 272 273Q: Why are my logs in GMT (UTC). 274 275A: You are running chrooted (-t) and have not supplied local timezone 276 information in the chroot area. 277 278 FreeBSD: /etc/localtime 279 Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo 280 OSF: /etc/zoneinfo/localtime 281 282 See also tzset(3) and zic(8). 283 284Q: I get "rndc: connect failed: connection refused" when I try to run 285 rndc. 286 287A: This is usually a configuration error. 288 289 First ensure that named is running and no errors are being reported at 290 startup (/var/log/messages or equivalent). Running "named -g <usual 291 arguments>" from a title can help at this point. 292 293 Secondly ensure that named is configured to use rndc either by 294 "rndc-confgen -a", rndc-confgen or manually. The Administrators 295 Reference manual has details on how to do this. 296 297 Old versions of rndc-confgen used localhost rather than 127.0.0.1 in / 298 etc/rndc.conf for the default server. Update /etc/rndc.conf if 299 necessary so that the default server listed in /etc/rndc.conf matches 300 the addresses used in named.conf. "localhost" has two address 301 (127.0.0.1 and ::1). 302 303 If you use "rndc-confgen -a" and named is running with -t or -u ensure 304 that /etc/rndc.conf has the correct ownership and that a copy is in the 305 chroot area. You can do this by re-running "rndc-confgen -a" with 306 appropriate -t and -u arguments. 307 308Q: I get "transfer of 'example.net/IN' from 192.168.4.12#53: failed while 309 receiving responses: permission denied" error messages. 310 311A: These indicate a filesystem permission error preventing named creating 312 / renaming the temporary file. These will usually also have other 313 associated error messages like 314 315 "dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied" 316 317 Named needs write permission on the directory containing the file. 318 Named writes the new cache file to a temporary file then renames it to 319 the name specified in named.conf to ensure that the contents are always 320 complete. This is to prevent named loading a partial zone in the event 321 of power failure or similar interrupting the write of the master file. 322 323 Note file names are relative to the directory specified in options and 324 any chroot directory ([<chroot dir>/][<options dir>]). 325 326 If named is invoked as "named -t /chroot/DNS" with the following 327 named.conf then "/chroot/DNS/var/named/sl" needs to be writable by the 328 user named is running as. 329 330 options { 331 directory "/var/named"; 332 }; 333 334 zone "example.net" { 335 type slave; 336 file "sl/example.net"; 337 masters { 192.168.4.12; }; 338 }; 339 340Q: I want to forward all DNS queries from my caching nameserver to another 341 server. But there are some domains which have to be served locally, via 342 rbldnsd. 343 344 How do I achieve this ? 345 346A: options { 347 forward only; 348 forwarders { <ip.of.primary.nameserver>; }; 349 }; 350 351 zone "sbl-xbl.spamhaus.org" { 352 type forward; forward only; 353 forwarders { <ip.of.rbldns.server> port 530; }; 354 }; 355 356 zone "list.dsbl.org" { 357 type forward; forward only; 358 forwarders { <ip.of.rbldns.server> port 530; }; 359 }; 360 361 362Q: Can you help me understand how BIND 9 uses memory to store DNS zones? 363 364 Some times it seems to take several times the amount of memory it needs 365 to store the zone. 366 367A: When reloading a zone named my have multiple copies of the zone in 368 memory at one time. The zone it is serving and the one it is loading. 369 If reloads are ultra fast it can have more still. 370 371 e.g. Ones that are transferring out, the one that it is serving and the 372 one that is loading. 373 374 BIND 8 destroyed the zone before loading and also killed off outgoing 375 transfers of the zone. 376 377 The new strategy allows slaves to get copies of the new zone regardless 378 of how often the master is loaded compared to the transfer time. The 379 slave might skip some intermediate versions but the transfers will 380 complete and it will keep reasonably in sync with the master. 381 382 The new strategy also allows the master to recover from syntax and 383 other errors in the master file as it still has an in-core copy of the 384 old contents. 385 386Q: I want to use IPv6 locally but I don't have a external IPv6 connection. 387 External lookups are slow. 388 389A: You can use server clauses to stop named making external lookups over 390 IPv6. 391 392 server fd81:ec6c:bd62::/48 { bogus no; }; // site ULA prefix 393 server ::/0 { bogus yes; }; 394 3953. Operations Questions 396 397Q: How to change the nameservers for a zone? 398 399A: Step 1: Ensure all nameservers, new and old, are serving the same zone 400 content. 401 402 Step 2: Work out the maximum TTL of the NS RRset in the parent and 403 child zones. This is the time it will take caches to be clear of a 404 particular version of the NS RRset. If you are just removing 405 nameservers you can skip to Step 6. 406 407 Step 3: Add new nameservers to the NS RRset for the zone and wait until 408 all the servers for the zone are answering with this new NS RRset. 409 410 Step 4: Inform the parent zone of the new NS RRset then wait for all 411 the parent servers to be answering with the new NS RRset. 412 413 Step 5: Wait for cache to be clear of the old NS RRset. See Step 2 for 414 how long. If you are just adding nameservers you are done. 415 416 Step 6: Remove any old nameservers from the zones NS RRset and wait for 417 all the servers for the zone to be serving the new NS RRset. 418 419 Step 7: Inform the parent zone of the new NS RRset then wait for all 420 the parent servers to be answering with the new NS RRset. 421 422 Step 8: Wait for cache to be clear of the old NS RRset. See Step 2 for 423 how long. 424 425 Step 9: Turn off the old nameservers or remove the zone entry from the 426 configuration of the old nameservers. 427 428 Step 10: Increment the serial number and wait for the change to be 429 visible in all nameservers for the zone. This ensures that zone 430 transfers are still working after the old servers are decommissioned. 431 432 Note: the above procedure is designed to be transparent to dns clients. 433 Decommissioning the old servers too early will result in some clients 434 not being able to look up answers in the zone. 435 436 Note: while it is possible to run the addition and removal stages 437 together it is not recommended. 438 4394. General Questions 440 441Q: I keep getting log messages like the following. Why? 442 443 Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN': 444 update failed: 'RRset exists (value dependent)' prerequisite not 445 satisfied (NXRRSET) 446 447A: DNS updates allow the update request to test to see if certain 448 conditions are met prior to proceeding with the update. The message 449 above is saying that conditions were not met and the update is not 450 proceeding. See doc/rfc/rfc2136.txt for more details on prerequisites. 451 452Q: I keep getting log messages like the following. Why? 453 454 Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied 455 456A: Someone is trying to update your DNS data using the RFC2136 Dynamic 457 Update protocol. Windows 2000 machines have a habit of sending dynamic 458 update requests to DNS servers without being specifically configured to 459 do so. If the update requests are coming from a Windows 2000 machine, 460 see <http://support.microsoft.com/support/kb/articles/q246/8/04.asp> 461 for information about how to turn them off. 462 463Q: When I do a "dig . ns", many of the A records for the root servers are 464 missing. Why? 465 466A: This is normal and harmless. It is a somewhat confusing side effect of 467 the way BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 468 makes to avoid promoting glue into answers. 469 470 When BIND 9 first starts up and primes its cache, it receives the root 471 server addresses as additional data in an authoritative response from a 472 root server, and these records are eligible for inclusion as additional 473 data in responses. Subsequently it receives a subset of the root server 474 addresses as additional data in a non-authoritative (referral) response 475 from a root server. This causes the addresses to now be considered 476 non-authoritative (glue) data, which is not eligible for inclusion in 477 responses. 478 479 The server does have a complete set of root server addresses cached at 480 all times, it just may not include all of them as additional data, 481 depending on whether they were last received as answers or as glue. You 482 can always look up the addresses with explicit queries like "dig 483 a.root-servers.net A". 484 485Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP? 486 487A: A zone can be updated either by editing zone files and reloading the 488 server or by dynamic update, but not both. If you have enabled dynamic 489 update for a zone using the "allow-update" option, you are not supposed 490 to edit the zone file by hand, and the server will not attempt to 491 reload it. 492 493Q: Why is named listening on UDP port other than 53? 494 495A: Named uses a system selected port to make queries of other nameservers. 496 This behaviour can be overridden by using query-source to lock down the 497 port and/or address. See also notify-source and transfer-source. 498 499Q: I get warning messages like "zone example.com/IN: refresh: failure 500 trying master 1.2.3.4#53: timed out". 501 502A: Check that you can make UDP queries from the slave to the master 503 504 dig +norec example.com soa @1.2.3.4 505 506 You could be generating queries faster than the slave can cope with. 507 Lower the serial query rate. 508 509 serial-query-rate 5; // default 20 510 511Q: I don't get RRSIG's returned when I use "dig +dnssec". 512 513A: You need to ensure DNSSEC is enabled (dnssec-enable yes;). 514 515Q: Can a NS record refer to a CNAME. 516 517A: No. The rules for glue (copies of the *address* records in the parent 518 zones) and additional section processing do not allow it to work. 519 520 You would have to add both the CNAME and address records (A/AAAA) as 521 glue to the parent zone and have CNAMEs be followed when doing 522 additional section processing to make it work. No nameserver 523 implementation supports either of these requirements. 524 525Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA" 526 mean? 527 528A: If the IN-ADDR.ARPA name covered refers to a internal address space you 529 are using then you have failed to follow RFC 1918 usage rules and are 530 leaking queries to the Internet. You should establish your own zones 531 for these addresses to prevent you querying the Internet's name servers 532 for these addresses. Please see <http://as112.net/> for details of the 533 problems you are causing and the counter measures that have had to be 534 deployed. 535 536 If you are not using these private addresses then a client has queried 537 for them. You can just ignore the messages, get the offending client to 538 stop sending you these messages as they are most probably leaking them 539 or setup your own zones empty zones to serve answers to these queries. 540 541 zone "10.IN-ADDR.ARPA" { 542 type master; 543 file "empty"; 544 }; 545 546 zone "16.172.IN-ADDR.ARPA" { 547 type master; 548 file "empty"; 549 }; 550 551 ... 552 553 zone "31.172.IN-ADDR.ARPA" { 554 type master; 555 file "empty"; 556 }; 557 558 zone "168.192.IN-ADDR.ARPA" { 559 type master; 560 file "empty"; 561 }; 562 563 empty: 564 @ 10800 IN SOA <name-of-server>. <contact-email>. ( 565 1 3600 1200 604800 10800 ) 566 @ 10800 IN NS <name-of-server>. 567 568 Note 569 570 Future versions of named are likely to do this automatically. 571 572Q: Will named be affected by the 2007 changes to daylight savings rules in 573 the US. 574 575A: No, so long as the machines internal clock (as reported by "date -u") 576 remains at UTC. The only visible change if you fail to upgrade your OS, 577 if you are in a affected area, will be that log messages will be a hour 578 out during the period where the old rules do not match the new rules. 579 580 For most OS's this change just means that you need to update the 581 conversion rules from UTC to local time. Normally this involves 582 updating a file in /etc (which sets the default timezone for the 583 machine) and possibly a directory which has all the conversion rules 584 for the world (e.g. /usr/share/zoneinfo). When updating the OS do not 585 forget to update any chroot areas as well. See your OS's documentation 586 for more details. 587 588 The local timezone conversion rules can also be done on a individual 589 basis by setting the TZ environment variable appropriately. See your 590 OS's documentation for more details. 591 592Q: Is there a bugzilla (or other tool) database that mere mortals can have 593 (read-only) access to for bind? 594 595A: No. The BIND 9 bug database is kept closed for a number of reasons. 596 These include, but are not limited to, that the database contains 597 proprietory information from people reporting bugs. The database has in 598 the past and may in future contain unfixed bugs which are capable of 599 bringing down most of the Internet's DNS infrastructure. 600 601 The release pages for each version contain up to date lists of bugs 602 that have been fixed post release. That is as close as we can get to 603 providing a bug database. 604 605Q: Why do queries for NSEC3 records fail to return the NSEC3 record? 606 607A: NSEC3 records are strictly meta data and can only be returned in the 608 authority section. This is done so that signing the zone using NSEC3 609 records does not bring names into existence that do not exist in the 610 unsigned version of the zone. 611 6125. Operating-System Specific Questions 613 6145.1. HPUX 615 616Q: I get the following error trying to configure BIND: 617 618 checking if unistd.h or sys/types.h defines fd_set... no 619 configure: error: need either working unistd.h or sys/select.h 620 621A: You have attempted to configure BIND with the bundled C compiler. This 622 compiler does not meet the minimum compiler requirements to for 623 building BIND. You need to install a ANSI C compiler and / or teach 624 configure how to find the ANSI C compiler. The later can be done by 625 adjusting the PATH environment variable and / or specifying the 626 compiler via CC. 627 628 ./configure CC=<compiler> ... 629 6305.2. Linux 631 632Q: Why do I get the following errors: 633 634 general: errno2result.c:109: unexpected error: 635 general: unable to convert errno to isc_result: 14: Bad address 636 client: UDP client handler shutting down due to fatal receive error: unexpected error 637 638A: This is the result of a Linux kernel bug. 639 640 See: <http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w= 641 2> 642 643Q: Why does named lock up when it attempts to connect over IPSEC tunnels? 644 645A: This is due to a kernel bug where the fact that a socket is marked 646 non-blocking is ignored. It is reported that setting xfrm_larval_drop 647 to 1 helps but this may have negative side effects. See: <https:// 648 bugzilla.redhat.com/show_bug.cgi?id=427629> and <http://lkml.org/lkml/ 649 2007/12/4/260>. 650 651 xfrm_larval_drop can be set to 1 by the following procedure: 652 653 echo "1" > proc/sys/net/core/xfrm_larval_drop 654 655Q: Why do I see 5 (or more) copies of named on Linux? 656 657A: Linux threads each show up as a process under ps. The approximate 658 number of threads running is n+4, where n is the number of CPUs. Note 659 that the amount of memory used is not cumulative; if each process is 660 using 10M of memory, only a total of 10M is used. 661 662 Newer versions of Linux's ps command hide the individual threads and 663 require -L to display them. 664 665Q: Why does BIND 9 log "permission denied" errors accessing its 666 configuration files or zones on my Linux system even though it is 667 running as root? 668 669A: On Linux, BIND 9 drops most of its root privileges on startup. This 670 including the privilege to open files owned by other users. Therefore, 671 if the server is running as root, the configuration files and zone 672 files should also be owned by root. 673 674Q: I get the error message "named: capset failed: Operation not permitted" 675 when starting named. 676 677A: The capability module, part of "Linux Security Modules/LSM", has not 678 been loaded into the kernel. See insmod(8), modprobe(8). 679 680 The relevant modules can be loaded by running: 681 682 modprobe commoncap 683 modprobe capability 684 685Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core - 686 687 Why can't named update slave zone database files? 688 689 Why can't named create DDNS journal files or update the master zones 690 from journals? 691 692 Why can't named create custom log files? 693 694A: Red Hat Security Enhanced Linux (SELinux) policy security protections : 695 696 Red Hat have adopted the National Security Agency's SELinux security 697 policy (see <http://www.nsa.gov/selinux>) and recommendations for BIND 698 security , which are more secure than running named in a chroot and 699 make use of the bind-chroot environment unnecessary . 700 701 By default, named is not allowed by the SELinux policy to write, create 702 or delete any files EXCEPT in these directories: 703 704 $ROOTDIR/var/named/slaves 705 $ROOTDIR/var/named/data 706 $ROOTDIR/var/tmp 707 708 709 where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is 710 installed. 711 712 The SELinux policy particularly does NOT allow named to modify the 713 $ROOTDIR/var/named directory, the default location for master zone 714 database files. 715 716 SELinux policy overrules file access permissions - so even if all the 717 files under /var/named have ownership named:named and mode rw-rw-r--, 718 named will still not be able to write or create files except in the 719 directories above, with SELinux in Enforcing mode. 720 721 So, to allow named to update slave or DDNS zone files, it is best to 722 locate them in $ROOTDIR/var/named/slaves, with named.conf zone 723 statements such as: 724 725 zone "slave.zone." IN { 726 type slave; 727 file "slaves/slave.zone.db"; 728 ... 729 }; 730 zone "ddns.zone." IN { 731 type master; 732 allow-updates {...}; 733 file "slaves/ddns.zone.db"; 734 }; 735 736 737 To allow named to create its cache dump and statistics files, for 738 example, you could use named.conf options statements such as: 739 740 options { 741 ... 742 dump-file "/var/named/data/cache_dump.db"; 743 statistics-file "/var/named/data/named_stats.txt"; 744 ... 745 }; 746 747 748 You can also tell SELinux to allow named to update any zone database 749 files, by setting the SELinux tunable boolean parameter 750 'named_write_master_zones=1', using the system-config-securitylevel 751 GUI, using the 'setsebool' command, or in /etc/selinux/targeted/ 752 booleans. 753 754 You can disable SELinux protection for named entirely by setting the 755 'named_disable_trans=1' SELinux tunable boolean parameter. 756 757 The SELinux named policy defines these SELinux contexts for named: 758 759 named_zone_t : for zone database files - $ROOTDIR/var/named/* 760 named_conf_t : for named configuration files - $ROOTDIR/etc/{named,rndc}.* 761 named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}} 762 763 764 If you want to retain use of the SELinux policy for named, and put 765 named files in different locations, you can do so by changing the 766 context of the custom file locations . 767 768 To create a custom configuration file location, e.g. '/root/ 769 named.conf', to use with the 'named -c' option, do: 770 771 # chcon system_u:object_r:named_conf_t /root/named.conf 772 773 774 To create a custom modifiable named data location, e.g. '/var/log/ 775 named' for a log file, do: 776 777 # chcon system_u:object_r:named_cache_t /var/log/named 778 779 780 To create a custom zone file location, e.g. /root/zones/, do: 781 782 # chcon system_u:object_r:named_zone_t /root/zones/{.,*} 783 784 785 See these man-pages for more information : selinux(8), named_selinux 786 (8), chcon(1), setsebool(8) 787 788Q: I'm running BIND on Ubuntu - 789 790 Why can't named update slave zone database files? 791 792 Why can't named create DDNS journal files or update the master zones 793 from journals? 794 795 Why can't named create custom log files? 796 797A: Ubuntu uses AppArmor <http://en.wikipedia.org/wiki/AppArmor> in 798 addition to normal file system permissions to protect the system. 799 800 Adjust the paths to use those specified in /etc/apparmor.d/ 801 usr.sbin.named or adjust /etc/apparmor.d/usr.sbin.named to allow named 802 to write at the location specified in named.conf. 803 804Q: Listening on individual IPv6 interfaces does not work. 805 806A: This is usually due to "/proc/net/if_inet6" not being available in the 807 chroot file system. Mount another instance of "proc" in the chroot file 808 system. 809 810 This can be be made permanent by adding a second instance to /etc/ 811 fstab. 812 813 proc /proc proc defaults 0 0 814 proc /var/named/proc proc defaults 0 0 815 8165.3. Windows 817 818Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. 819 Why? 820 821A: This may be caused by a bug in the Windows 2000 DNS server where DNS 822 messages larger than 16K are not handled properly. This can be worked 823 around by setting the option "transfer-format one-answer;". Also check 824 whether your zone contains domain names with embedded spaces or other 825 special characters, like "John\032Doe\213s\032Computer", since such 826 names have been known to cause Windows 2000 slaves to incorrectly 827 reject the zone. 828 829Q: I get "Error 1067" when starting named under Windows. 830 831A: This is the service manager saying that named exited. You need to 832 examine the Application log in the EventViewer to find out why. 833 834 Common causes are that you failed to create "named.conf" (usually "C:\ 835 windows\dns\etc\named.conf") or failed to specify the directory in 836 named.conf. 837 838 options { 839 Directory "C:\windows\dns\etc"; 840 }; 841 8425.4. FreeBSD 843 844Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there. 845 846A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to 847 use certain interrupts as a source of random events. You can make this 848 permanent by setting rand_irqs in /etc/rc.conf. 849 850 rand_irqs="3 14 15" 851 852 See also <http://people.freebsd.org/~dougb/randomness.html>. 853 8545.5. Solaris 855 856Q: How do I integrate BIND 9 and Solaris SMF 857 858A: Sun has a blog entry describing how to do this. 859 860 <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris> 861 8625.6. Apple Mac OS X 863 864Q: How do I run BIND 9 on Apple Mac OS X? 865 866A: If you run Tiger(Mac OS 10.4) or later then this is all you need to do: 867 868 % sudo rndc-confgen > /etc/rndc.conf 869 870 Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.: 871 872 key "rndc-key" { 873 algorithm hmac-sha256; 874 secret "uvceheVuqf17ZwIcTydddw=="; 875 }; 876 877 Then start the relevant service: 878 879 % sudo service org.isc.named start 880 881 This is persistent upon a reboot, so you will have to do it only once. 882 883A: Alternatively you can just generate /etc/rndc.key by running: 884 885 % sudo rndc-confgen -a 886 887 Then start the relevant service: 888 889 % sudo service org.isc.named start 890 891 Named will look for /etc/rndc.key when it starts if it doesn't have a 892 controls section or the existing controls are missing keys sub-clauses. 893 This is persistent upon a reboot, so you will have to do it only once. 894 895