(resolved: AppArmor was the reason of that failure. I just run: aa-logprof and restarted bind)

I added second interface to my server

and after I restarted my server I have found out that BIND is not starting.

If I try: sudo /etc/init.d/bind9 restart I'm. getting

 * Stopping domain name service... bind9
    rndc: connect failed: connection refused
                                                               [ OK ]
 * Starting domain name service... bind9

contents from /var/log/syslog:

Aug 12 15:50:36 server1 named[1127]: configuring TKEY: failure
Aug 12 15:50:36 server1 named[1127]: loading configuration: failure
Aug 12 15:50:36 server1 named[1127]: exiting (due to fatal error)
Aug 12 15:50:36 server1 kernel: [   38.746404] type=1400 audit(1313142636.718:15): apparmor="DENIED" operation="file_lock" parent=1126 profile="/usr/sbin/named" name="/usr/local/samba/private/dns.keytab" pid=1128 comm="named" requested_mask="k" denied_mask="k" fsuid=103 ouid=103

However I think the problem is not coming from the second interface as I removed it and rebooted. Having the same issue.

  • 1
    You should write a description of your solution and how you arrived at it in an answer, which you should then accept. This way people having the same issue can learn from your experience. – Michael Lowman Aug 12 '11 at 13:02

AppArmor was the reason of that failure. He just ran: aa-logprof and restarted bind.

(Blatently stolen from the Question, but he didn't post it as an answer)

| improve this answer | |
  • 1
    I just didn't have enough permissions to post an answer for my own question for 8 hours after question was published – bakytn Aug 13 '11 at 10:38

Run this:

named -g

It will start the bind9 server in foreground and print all the errors it encounters to stderr so you can figure out what's wrong with it.

| improve this answer | |
  • thank you, I have updated the question and added messages from /var/log/syslog If I run named -g I am getting the same except the last line – bakytn Aug 12 '11 at 9:59
  • Are you running your system with selinux policy set to 'enforcing' by any chance? – O G Aug 12 '11 at 10:04
  • O G, I am running Ubuntu Server I think there is no selinux. Thereis an apparmor. But I configured apparmor..and it worked fine earlier. No idea why now. The only change I made is added new interface. But I removed it..and problem is still here. – bakytn Aug 12 '11 at 10:05
  • See permissions in /etc/apparmor.d/usr.sbin.named and have the zone files in that location (/var/cache/bind I think). – O G Aug 12 '11 at 10:09
  • var cache bind already set look: /var/cache/bind/** rw, /var/cache/bind/ rw, – bakytn Aug 12 '11 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.