Bind9 - Permission issue
Clash Royale CLAN TAG#URR8PPP up vote
1
down vote
favorite
I had BIND9 installed and working ok. I wanted to output the logs for parsing into MUNIN.
I had the system working fine, and had the log files generating in /var/cache/bind/ with ownership as root:bind and permissions set as 0644.
However upon reboot BIND9 is no longer started, and an excerpt from the /var/log/syslog shows this:
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 64.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 65.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: isc_stdio_open '/var/cache/bind/debug.log' failed: permission denied
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 66.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 67.100.IN-ADDR.ARPA
If I start BIND9 manually it starts, however the above error is still shown.
Any ideas why it stops BIND9 from starting automatically, yet starts manually?
/etc/Apparmor.d/usr.sbin.named:
# /etc/bind should be read-only for bind
# /var/lib/bind is for dynamically updated zone (and journal) files.
# /var/cache/bind is for slave/stub data, since we're not the origin of it.
# See /usr/share/doc/bind9/README.Debian.gz
/etc/bind/** r,
/var/lib/bind/** rw,
/var/lib/bind/ rw,
/var/cache/bind/** lrw,
/var/cache/bind/ rw,
/var/log/bind9/** rw,
/var/log/bind/ rw,
Thanks
Tom
networking permissions 17.10 dns
edited Mar 14 at 22:01
Sebastian Stark
4,723938
asked Mar 14 at 21:55
Tom Aspland
62
add a comment |Â
up vote
1
down vote
favorite
I had BIND9 installed and working ok. I wanted to output the logs for parsing into MUNIN.
I had the system working fine, and had the log files generating in /var/cache/bind/ with ownership as root:bind and permissions set as 0644.
However upon reboot BIND9 is no longer started, and an excerpt from the /var/log/syslog shows this:
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 64.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 65.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: isc_stdio_open '/var/cache/bind/debug.log' failed: permission denied
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 66.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 67.100.IN-ADDR.ARPA
If I start BIND9 manually it starts, however the above error is still shown.
Any ideas why it stops BIND9 from starting automatically, yet starts manually?
/etc/Apparmor.d/usr.sbin.named:
# /etc/bind should be read-only for bind
# /var/lib/bind is for dynamically updated zone (and journal) files.
# /var/cache/bind is for slave/stub data, since we're not the origin of it.
# See /usr/share/doc/bind9/README.Debian.gz
/etc/bind/** r,
/var/lib/bind/** rw,
/var/lib/bind/ rw,
/var/cache/bind/** lrw,
/var/cache/bind/ rw,
/var/log/bind9/** rw,
/var/log/bind/ rw,
Thanks
Tom
networking permissions 17.10 dns
edited Mar 14 at 22:01
Sebastian Stark
4,723938
asked Mar 14 at 21:55
Tom Aspland
62
what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
– Sebastian Stark
Mar 14 at 22:02
Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
– Tom Aspland
Mar 14 at 22:10
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I had BIND9 installed and working ok. I wanted to output the logs for parsing into MUNIN.
I had the system working fine, and had the log files generating in /var/cache/bind/ with ownership as root:bind and permissions set as 0644.
However upon reboot BIND9 is no longer started, and an excerpt from the /var/log/syslog shows this:
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 64.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 65.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: isc_stdio_open '/var/cache/bind/debug.log' failed: permission denied
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 66.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 67.100.IN-ADDR.ARPA
If I start BIND9 manually it starts, however the above error is still shown.
Any ideas why it stops BIND9 from starting automatically, yet starts manually?
/etc/Apparmor.d/usr.sbin.named:
# /etc/bind should be read-only for bind
# /var/lib/bind is for dynamically updated zone (and journal) files.
# /var/cache/bind is for slave/stub data, since we're not the origin of it.
# See /usr/share/doc/bind9/README.Debian.gz
/etc/bind/** r,
/var/lib/bind/** rw,
/var/lib/bind/ rw,
/var/cache/bind/** lrw,
/var/cache/bind/ rw,
/var/log/bind9/** rw,
/var/log/bind/ rw,
Thanks
Tom
networking permissions 17.10 dns
edited Mar 14 at 22:01
Sebastian Stark
4,723938
asked Mar 14 at 21:55
Tom Aspland
62
I had BIND9 installed and working ok. I wanted to output the logs for parsing into MUNIN.
I had the system working fine, and had the log files generating in /var/cache/bind/ with ownership as root:bind and permissions set as 0644.
However upon reboot BIND9 is no longer started, and an excerpt from the /var/log/syslog shows this:
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 64.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 65.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: isc_stdio_open '/var/cache/bind/debug.log' failed: permission denied
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 66.100.IN-ADDR.ARPA
Mar 14 20:45:57 minecraftsvr named[867]: automatic empty zone: 67.100.IN-ADDR.ARPA
If I start BIND9 manually it starts, however the above error is still shown.
Any ideas why it stops BIND9 from starting automatically, yet starts manually?
/etc/Apparmor.d/usr.sbin.named:
# /etc/bind should be read-only for bind
# /var/lib/bind is for dynamically updated zone (and journal) files.
# /var/cache/bind is for slave/stub data, since we're not the origin of it.
# See /usr/share/doc/bind9/README.Debian.gz
/etc/bind/** r,
/var/lib/bind/** rw,
/var/lib/bind/ rw,
/var/cache/bind/** lrw,
/var/cache/bind/ rw,
/var/log/bind9/** rw,
/var/log/bind/ rw,
Thanks
Tom
networking permissions 17.10 dns
networking permissions 17.10 dns
edited Mar 14 at 22:01
Sebastian Stark
4,723938
asked Mar 14 at 21:55
Tom Aspland
62
edited Mar 14 at 22:01
Sebastian Stark
4,723938
asked Mar 14 at 21:55
Tom Aspland
62
edited Mar 14 at 22:01
Sebastian Stark
4,723938
edited Mar 14 at 22:01
Sebastian Stark
4,723938
edited Mar 14 at 22:01
Sebastian Stark
4,723938
4,723938
asked Mar 14 at 21:55
Tom Aspland
62
asked Mar 14 at 21:55
Tom Aspland
62
asked Mar 14 at 21:55
Tom Aspland
62
62
what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
– Sebastian Stark
Mar 14 at 22:02
Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
– Tom Aspland
Mar 14 at 22:10
add a comment |Â
what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
– Sebastian Stark
Mar 14 at 22:02
Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
– Tom Aspland
Mar 14 at 22:10
what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
– Sebastian Stark
Mar 14 at 22:02
what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
– Sebastian Stark
Mar 14 at 22:02
Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
– Tom Aspland
Mar 14 at 22:10
Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
– Tom Aspland
Mar 14 at 22:10
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1015004%2fbind9-permission-issue%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
what permissions does /var/cache/bind/debug.log have and under which user/group do you run bind9?
– Sebastian Stark
Mar 14 at 22:02
Hi, having had a look its running as root :-(. How can I modify it to run as the user bind/group bind as obviously I dont want to really run it as root. Further, I tried changing the owner of the /var/cache/bind.log debug.log and query.log as root:root with no success either.
– Tom Aspland
Mar 14 at 22:10