Bind9 - Permission issue

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP








up vote
1
down vote

favorite












I had BIND9 installed and working ok. I wanted to output the logs for parsing into MUNIN.
I had the system working fine, and had the log files generating in /var/cache/bind/ with ownership as root:bind and permissions set as 0644.



However upon reboot BIND9 is no longer started, and an excerpt from the /var/log/syslog shows this:



Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 64.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 65.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: isc_stdio_open '/var/cache/bind/debug.log' failed: permission denied
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 66.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 67.100.IN-ADDR.ARPA


If I start BIND9 manually it starts, however the above error is still shown.



Any ideas why it stops BIND9 from starting automatically, yet starts manually?



/etc/Apparmor.d/usr.sbin.named:



 # /etc/bind should be read-only for bind
 # /var/lib/bind is for dynamically updated zone (and journal) files.
 # /var/cache/bind is for slave/stub data, since we're not the origin of it.
 # See /usr/share/doc/bind9/README.Debian.gz
 /etc/bind/** r,
 /var/lib/bind/** rw,
 /var/lib/bind/ rw,
 /var/cache/bind/** lrw,
 /var/cache/bind/ rw,
 /var/log/bind9/** rw,
 /var/log/bind/ rw,


Thanks
Tom






networking permissions 17.10 dns







share|improve this question























  • what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
    – Sebastian Stark
    Mar 14 at 22:02










  • Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
    – Tom Aspland
    Mar 14 at 22:10















up vote
1
down vote

favorite












I had BIND9 installed and working ok. I wanted to output the logs for parsing into MUNIN.
I had the system working fine, and had the log files generating in /var/cache/bind/ with ownership as root:bind and permissions set as 0644.



However upon reboot BIND9 is no longer started, and an excerpt from the /var/log/syslog shows this:



Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 64.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 65.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: isc_stdio_open '/var/cache/bind/debug.log' failed: permission denied
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 66.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 67.100.IN-ADDR.ARPA


If I start BIND9 manually it starts, however the above error is still shown.



Any ideas why it stops BIND9 from starting automatically, yet starts manually?



/etc/Apparmor.d/usr.sbin.named:



 # /etc/bind should be read-only for bind
 # /var/lib/bind is for dynamically updated zone (and journal) files.
 # /var/cache/bind is for slave/stub data, since we're not the origin of it.
 # See /usr/share/doc/bind9/README.Debian.gz
 /etc/bind/** r,
 /var/lib/bind/** rw,
 /var/lib/bind/ rw,
 /var/cache/bind/** lrw,
 /var/cache/bind/ rw,
 /var/log/bind9/** rw,
 /var/log/bind/ rw,


Thanks
Tom






networking permissions 17.10 dns







share|improve this question























  • what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
    – Sebastian Stark
    Mar 14 at 22:02










  • Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
    – Tom Aspland
    Mar 14 at 22:10













up vote
1
down vote

favorite









up vote
1
down vote

favorite











I had BIND9 installed and working ok. I wanted to output the logs for parsing into MUNIN.
I had the system working fine, and had the log files generating in /var/cache/bind/ with ownership as root:bind and permissions set as 0644.



However upon reboot BIND9 is no longer started, and an excerpt from the /var/log/syslog shows this:



Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 64.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 65.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: isc_stdio_open '/var/cache/bind/debug.log' failed: permission denied
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 66.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 67.100.IN-ADDR.ARPA


If I start BIND9 manually it starts, however the above error is still shown.



Any ideas why it stops BIND9 from starting automatically, yet starts manually?



/etc/Apparmor.d/usr.sbin.named:



 # /etc/bind should be read-only for bind
 # /var/lib/bind is for dynamically updated zone (and journal) files.
 # /var/cache/bind is for slave/stub data, since we're not the origin of it.
 # See /usr/share/doc/bind9/README.Debian.gz
 /etc/bind/** r,
 /var/lib/bind/** rw,
 /var/lib/bind/ rw,
 /var/cache/bind/** lrw,
 /var/cache/bind/ rw,
 /var/log/bind9/** rw,
 /var/log/bind/ rw,


Thanks
Tom






networking permissions 17.10 dns







share|improve this question















I had BIND9 installed and working ok. I wanted to output the logs for parsing into MUNIN.
I had the system working fine, and had the log files generating in /var/cache/bind/ with ownership as root:bind and permissions set as 0644.



However upon reboot BIND9 is no longer started, and an excerpt from the /var/log/syslog shows this:



Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 64.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 65.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: isc_stdio_open '/var/cache/bind/debug.log' failed: permission denied
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 66.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 67.100.IN-ADDR.ARPA


If I start BIND9 manually it starts, however the above error is still shown.



Any ideas why it stops BIND9 from starting automatically, yet starts manually?



/etc/Apparmor.d/usr.sbin.named:



 # /etc/bind should be read-only for bind
 # /var/lib/bind is for dynamically updated zone (and journal) files.
 # /var/cache/bind is for slave/stub data, since we're not the origin of it.
 # See /usr/share/doc/bind9/README.Debian.gz
 /etc/bind/** r,
 /var/lib/bind/** rw,
 /var/lib/bind/ rw,
 /var/cache/bind/** lrw,
 /var/cache/bind/ rw,
 /var/log/bind9/** rw,
 /var/log/bind/ rw,


Thanks
Tom






networking permissions 17.10 dns




networking permissions 17.10 dns






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Mar 14 at 22:01









Sebastian Stark

4,723938




4,723938










asked Mar 14 at 21:55









Tom Aspland

62




62











  • what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
    – Sebastian Stark
    Mar 14 at 22:02










  • Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
    – Tom Aspland
    Mar 14 at 22:10

















  • what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
    – Sebastian Stark
    Mar 14 at 22:02










  • Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
    – Tom Aspland
    Mar 14 at 22:10
















what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
– Sebastian Stark
Mar 14 at 22:02




what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
– Sebastian Stark
Mar 14 at 22:02












Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
– Tom Aspland
Mar 14 at 22:10





Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
– Tom Aspland
Mar 14 at 22:10
















active

oldest

votes











Your Answer







StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













 

draft saved


draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1015004%2fbind9-permission-issue%23new-answer', 'question_page');

);

Post as a guest






















active

oldest

votes













active

oldest

votes









active

oldest

votes






active

oldest

votes















 

draft saved


draft discarded















































 


draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1015004%2fbind9-permission-issue%23new-answer', 'question_page');

);

Post as a guest
































































-

Popular posts from this blog

Which professions warranted travel in Medieval times?

Image
Clash Royale CLAN TAG #URR8PPP up vote 54 down vote favorite 15 I'm trying to come up with characters whose backgrounds allow them to have homes, histories, and skills, but will still enable or encourage them to travel in a typical medieval setting. I've never really liked "Adventurer" as a job, and would like my story to have a kind of unlikely-hero vibe. besides the common "Traveling merchant", what kinds of artisans or professionals in fantasy would have a reason to move around the world (or at least visit other settlements)? First time posting, so let me know what to improve. Thanks! EDIT: When I say traveling, I was thinking someone who spends multiple days/weeks/months away from their place of origin as they go elsewhere for their business, or to gather materials for it. medieval travel share | improve this question edited Aug 1 at 15:16 asked Aug 1 at 15:07 Julia Witham 279 2 7 11 Please ...
Read more

How do so many people here on Academia.SE, and in general, afford lavish higher education programs?

Image
Clash Royale CLAN TAG #URR8PPP up vote 45 down vote favorite 7 I graduated last year with a BS in Computer Science. I do not come from a particularly wealthy family, (very low middle class), and was only able to afford my education via school loans/scholarships and working low-wage jobs, with no support from my family or anyone else. I realize some scholarship/loan programs extend into grad school. But I don't think those cover all costs. Now I'm lucky enough to have a decent-paying salary in industry, along with benefits and living on my own, and I'm thinking one day (sooner rather than later) I'd like to try my hand at research or continue my degree, but these things cost money, in addition to my regular living expenses. I read posts here often about academic people being in positions of choosing between these crazy research grad programs, some in Japan, or Ireland (while they currently live in the U.S./U.K.) then moving around between countries/universit...
Read more

Trouble downloading packages list due to a “Hash sum mismatch” error

Image
Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote 331 down vote favorite 117 When I check for updates, I get a "Failed To Download Repository Information" error. This is what comes up under details: W: Failed to fetch gzip:/var/lib/apt/lists/partial/us.archive.ubuntu.com_ubuntu_dists_natty_main_source_Sources Hash Sum mismatch, E: Some index files failed to download. They have been ignored, or old ones used instead. apt share | improve this question edited Nov 12 '14 at 23:37 Braiam 49.5k 19 130 210 asked May 9 '11 at 20:55 Rob 5,300 10 26 40 add a comment  |  up vote 331 down vote favorite 117 When I check for updates, I get a "Failed To Download Repository Information" error. This is what comes up under details: W: Failed to fetch gzip:/var/lib/apt/lists/partial/us.archive.ubuntu.com_ubuntu_dists_nat...
Read more