0

I did a fresh install of powerdns on CentOS 8 Desktop. When running the service on port 53 everything runs without issue. When changing the port 5300 it errors out. I receive this error message:

visitel-vpn1.localdomain systemd[1]: Started PowerDNS Authoritative Server.
Loading '/usr/lib64/pdns/libgmysqlbackend.so'
This is a standalone pdns
Listening on controlsocket in '/var/run/pdns/pdns.controlsocket'
Unable to bind UDP socket to '0.0.0.0:5300': Permission denied
Fatal error: Unable to bind to UDP socket

here is my service file. I stripped down the service file to bare minimum and added the --local-port to the command line parameter.

[Unit]
Description=PowerDNS Authoritative Server

[Service]
ExecStart=/usr/sbin/pdns_server --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no --local-port=5300
User=root
Group=root
RuntimeDirectory=pdns

[Install]
WantedBy=multi-user.target

Things I have tried:

  • running PowerDNS with default settings default port. WORKS
  • running as root in the console with port 5300. WORKS
  • PowerDNS on Ubuntu 20 Server running as service on port 5300. WORKS
  • disabled firewalld. FAIL
  • running powerDNS service with port 0.0.0.0:5300 or 127.0.0.0:5300 or [localip]:5300. FAIL
  • running PowerDNS on any port other than 53 such as 25, 1000, 1024, 54. FAIL

There is some security setting in CentOS 8 Desktop that is restricting services from binding to UDP ports. I can just run Ubuntu but I would like to know why it's failing on CentOS. Any ideas? Thanks.

2
  • 3
    My recommendation would be to look at SELinux. In my experience with RHEL-based systems port-based problems are almost always caused by either Firewalld (which you've already disabled) or SELinux. To test whether selinux is the problem run sudo setenforce 0 to disable it temporarily. Note, do not permanently disable selinux. If disabling it using setenforce 0 (and restarting the service) works then look into the selinux logs to see what you need to do to grant the service permission to use that port. – enpaul Dec 20 '20 at 17:42
  • 1
    make sure selinux is not blocking – Zareh Kasparian Dec 20 '20 at 18:06
2

SELinux only allows the DNS server to bind to ports labeled as dns_port_t, which currently are:

# semanage port -l | grep -w 53
dns_port_t                     tcp      53, 853
dns_port_t                     udp      53, 853

You can add your own custom port to allow this access.

# semanage port -a -t dns_port_t -p udp 5300
# semanage port -l | grep -w 53
dns_port_t                     tcp      53, 853
dns_port_t                     udp      5300, 53, 853

(You probably also need to allow TCP, and configure it in PowerDNS.)

1
  • I added both udp and tcp ports 5300. it works. I didn't know about SELinux I'll have to read up on it. Thank you. – manit Dec 20 '20 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.