1

(resolved: AppArmor was the reason of that failure. I just run: aa-logprof and restarted bind)

I added second interface to my server

and after I restarted my server I have found out that BIND is not starting.

If I try: sudo /etc/init.d/bind9 restart I'm. getting

 * Stopping domain name service... bind9
    rndc: connect failed: 127.0.0.1#953: connection refused
                                                               [ OK ]
 * Starting domain name service... bind9
                                                               [fail]

contents from /var/log/syslog:

Aug 12 15:50:36 server1 named[1127]: configuring TKEY: failure
Aug 12 15:50:36 server1 named[1127]: loading configuration: failure
Aug 12 15:50:36 server1 named[1127]: exiting (due to fatal error)
Aug 12 15:50:36 server1 kernel: [   38.746404] type=1400 audit(1313142636.718:15): apparmor="DENIED" operation="file_lock" parent=1126 profile="/usr/sbin/named" name="/usr/local/samba/private/dns.keytab" pid=1128 comm="named" requested_mask="k" denied_mask="k" fsuid=103 ouid=103

However I think the problem is not coming from the second interface as I removed it and rebooted. Having the same issue.

Improve this question
1
  • 1
    You should write a description of your solution and how you arrived at it in an answer, which you should then accept. This way people having the same issue can learn from your experience.
    – Michael Lowman
    Aug 12, 2011 at 13:02

2 Answers 2

Reset to default
2

AppArmor was the reason of that failure. He just ran: aa-logprof and restarted bind.

(Blatently stolen from the Question, but he didn't post it as an answer)

Improve this answer
1
  • 1
    I just didn't have enough permissions to post an answer for my own question for 8 hours after question was published
    – bakytn
    Aug 13, 2011 at 10:38
11

Run this:

named -g

It will start the bind9 server in foreground and print all the errors it encounters to stderr so you can figure out what's wrong with it.

Improve this answer
9
  • thank you, I have updated the question and added messages from /var/log/syslog If I run named -g I am getting the same except the last line
    – bakytn
    Aug 12, 2011 at 9:59
  • Are you running your system with selinux policy set to 'enforcing' by any chance?
    – O G
    Aug 12, 2011 at 10:04
  • O G, I am running Ubuntu Server I think there is no selinux. Thereis an apparmor. But I configured apparmor..and it worked fine earlier. No idea why now. The only change I made is added new interface. But I removed it..and problem is still here.
    – bakytn
    Aug 12, 2011 at 10:05
  • See permissions in /etc/apparmor.d/usr.sbin.named and have the zone files in that location (/var/cache/bind I think).
    – O G
    Aug 12, 2011 at 10:09
  • var cache bind already set look: /var/cache/bind/** rw, /var/cache/bind/ rw,
    – bakytn
    Aug 12, 2011 at 10:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .