up vote 0 down vote favorite
share [g+] share [fb]

(resolved: AppArmor was the reason of that failure. I just run: aa-logprof and restarted bind)

I added second interface to my server

and after I restarted my server I have found out that BIND is not starting.

If I try: sudo /etc/init.d/bind9 restart I'm. getting

 * Stopping domain name service... bind9
    rndc: connect failed: 127.0.0.1#953: connection refused
                                                               [ OK ]
 * Starting domain name service... bind9
                                                               [fail]

contents from /var/log/syslog:

Aug 12 15:50:36 server1 named[1127]: configuring TKEY: failure
Aug 12 15:50:36 server1 named[1127]: loading configuration: failure
Aug 12 15:50:36 server1 named[1127]: exiting (due to fatal error)
Aug 12 15:50:36 server1 kernel: [   38.746404] type=1400 audit(1313142636.718:15): apparmor="DENIED" operation="file_lock" parent=1126 profile="/usr/sbin/named" name="/usr/local/samba/private/dns.keytab" pid=1128 comm="named" requested_mask="k" denied_mask="k" fsuid=103 ouid=103

However I think the problem is not coming from the second interface as I removed it and rebooted. Having the same issue.

link|improve this question
78% accept rate
1  
You should write a description of your solution and how you arrived at it in an answer, which you should then accept. This way people having the same issue can learn from your experience. – Michael Lowman Aug 12 '11 at 13:02
feedback

2 Answers

up vote 2 down vote accepted

AppArmor was the reason of that failure. He just ran: aa-logprof and restarted bind.

(Blatently stolen from the Question, but he didn't post it as an answer)

link|improve this answer
I just didn't have enough permissions to post an answer for my own question for 8 hours after question was published – casey_miller Aug 13 '11 at 10:38
feedback
up vote 1 down vote

Run this:

named -g

It will start the bind9 server in foreground and print all the errors it encounters to stderr so you can figure out what's wrong with it.

link|improve this answer
thank you, I have updated the question and added messages from /var/log/syslog If I run named -g I am getting the same except the last line – casey_miller Aug 12 '11 at 9:59
Are you running your system with selinux policy set to 'enforcing' by any chance? – O G Aug 12 '11 at 10:04
O G, I am running Ubuntu Server I think there is no selinux. Thereis an apparmor. But I configured apparmor..and it worked fine earlier. No idea why now. The only change I made is added new interface. But I removed it..and problem is still here. – casey_miller Aug 12 '11 at 10:05
See permissions in /etc/apparmor.d/usr.sbin.named and have the zone files in that location (/var/cache/bind I think). – O G Aug 12 '11 at 10:09
var cache bind already set look: /var/cache/bind/** rw, /var/cache/bind/ rw, – casey_miller Aug 12 '11 at 10:16
show 4 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.