3

Using bind 9.8.2 on RHEL 6.5, running chroot'd.

I have a zone file that includes other files (it's a zone with a large number of servers in different datacenters, and there's one included file per datacenter).

The zone files and the included files are in 

/var/named/chroot/var/named/zones/master/example.com
/var/named/chroot/var/named/zones/master/lax01

The include files are referenced in the zone file relative to the chroot'd directory:

$INCLUDE zones/master/lax01

When trying to use dnssec-signzone to sign the zone, there's an error since it cannot seem to load the included file. 

# cd /var/named/chroot/var/named/zones/master
# dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) \
   -N INCREMENT -o example.com -t example.com
dnssec-signzone: error: dns_master_load: example.com:287: zones/master/lax01: file not found
dnssec-signzone: fatal: failed loading zone from 'example.com': file not found

Is there some better way to reference the path for the INCLUDE directive? I don't see a way to instruct dnssec-signzone to take the chroot directive into account. Do I need to do this from a different directory and reference the paths differently?

Improve this question

1 Answer 1

Reset to default
0

I don't think your chroot has anything to do with this. Even without a chroot, I would still expect that command to fail. dnssec-signzone is not reading from named.conf and has no awareness of the working directory specified via the directory option.

Given that this is the case, all included files will need to be relative to your current working directory. The command should work as expected if you execute it like this instead:

# cd /var/named/chroot/var/named
# dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) \
   -N INCREMENT -o example.com -t zones/master/example.com

Note that the directory we changed to is effectively the working directory of your BIND server at runtime.

Improve this answer
4
  • That totally makes sense. And it does seem to help. But I'm seeing another issue. I previous had "$INCLUDE Kdomain.com.+007+12512.key" at the end of the zone file, and now I get a file not found for that INCLUDE. So I tried changed that to "zones/master/Kdomain.com.+007+12512.key", but now I get "dnssec-signzone: warning: dns_dnssec_keylistfromrdataset: error reading private key file domain.com/NSEC3RSASHA1/12512: file not found"
    – T. Johnson
    Mar 9, 2016 at 0:00
  • Hmm. Actually, I would have expected those keys to be outputted to /var/named/chroot/var/named, which inside your config I'd expect to be the working directory. No directory prefix, in other words. If I'm wrong, you just need to think like the nameserver software and compare that to the files on disk. "My working directory is /var/named/chroot/var/named, what would the path to this file be?" You can also take a look at the dnssec-signzone manpage for how to influence the key paths. (-K and -d in particular)
    – Andrew B
    Mar 9, 2016 at 0:14
  • 1
    Using -K did it: dnssec-signzone -K /var/named/chroot/var/named/zones/master -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -N INCREMENT -o example.com -t ./zones/master/example.com
    – T. Johnson
    Mar 9, 2016 at 1:23
  • Sweet. If that covers all of it, please mark this question as answered so that it doesn't show as unanswered in the system.
    – Andrew B
    Mar 9, 2016 at 7:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .