Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Well for the better part of the last two hours I've tried to figure out what is actually wrong, but I can't seem to find anything obvious to me.

What I'm trying to do is setup my DNS for say(per example) domain.com. This should include two NS records, namely ns1.domain.com and ns2.domain.com. With that there should be a mail record, as well as a CNAME record for www.

I've been trough roughly 20 how to's in the last two hours, rewrote everything from scratch four times and I still can't seem to find whats wrong. My only suspicion to this might be two things; the error I get from the bind9 daemon when I stop the service, and the named.conf file.

The error I get from the bind9 daemon when stopping the service is:

* Stopping domain name service... bind9                                        rndc: connection to remote host closed
This may indicate that
* the remote server is using an older version of the command protocol,
* this host is not authorized to connect,
* the clocks are not syncronized, or
* the key is invalid.

I honestly doesn't know what this means, apart from the key defined in /etc/bind/rndc.key that's not in the named.conf file(yes, I did try to add it to no avail).

Here's all the zone files, and configuration files; http://208.77.101.5/bind9/

If anyone could help, it would be greatly appreciated.

share|improve this question
add comment

3 Answers

up vote 0 down vote accepted

To stop bind, the scripts use rndc stop command. Check if you run it by hands if you have the same answer. If it is the case, check netstat -pnlt | grep 953 if bind is waiting for your connections check if your keys in /etc/bind/rndc.key are the same in /etc/bind/named.conf

If you change the keys, you must kill the process as it will not be stopped by rndc, and then restart bind

share|improve this answer
    
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 11524/named tcp6 0 0 ::1:953 :::* LISTEN 11524/named There are no keys defined in /etc/bind/named.conf? –  ferdi May 12 '10 at 11:32
    
Do you use a bind version 9 ? Do you have the section key "rndc-key" { algorithm hmac-md5; secret "ddddd=="; }; somewhere ? –  Dom May 12 '10 at 11:53
    
I added it, and rndc-confgen confirms the key in both files. –  ferdi May 12 '10 at 12:15
    
Do you kill the process to reload the key in bind ? –  Dom May 12 '10 at 12:35
    
yes, but somehow It's been fixed. Although, I won't know if the DNS is actually working until it updates. But by using dig all NS, A, MX CNAME records seems to respond fine. –  ferdi May 12 '10 at 14:03
add comment

My /etc/bind/named.conf.local contains the following …

include "/etc/bind/rndc.key";

controls {
    inet 127.0.0.1 allow {
        localhost;
    }

    keys {
        rndc-key;
    };
};

As far as I remember, this tells bind to allow rndc connections from the localhost using the key defined in /etc/bind/rndc.key.

As root, you might try executing

# rndc -V status

to get rndc debugging messages which may help you diagnose why rndc is failing to connect to bind.

share|improve this answer
add comment

This error appeared to me during master-slave synchronization, and the problem was in different time of those machines. Try to ntpdate some timeserver.

share|improve this answer
    
"12 May 11:49:45 ntpdate[26410]: step-systime: Operation not permitted" so that's a no-go. –  ferdi May 12 '10 at 11:51
    
got ntpdate working, but the error still does not go away. –  ferdi May 12 '10 at 12:16
    
Try run it as root. Or use another tool to set time on machines. Time cannot be much different. –  mkudlacek May 12 '10 at 12:18
    
Sorry, I wrote previous message too long. It's not time problem then. –  mkudlacek May 12 '10 at 12:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.