BIND 9.3.5-P1 update corrupted no longer in chroot

Larry Gross doulos2k at gmail.com
Fri Aug 29 13:51:33 UTC 2008


We're running two nameservers on Fedora Core 4. I updated the
secondary nameserver from BIND 9.3.1 to 9.3.5-P1 without a hitch. This
was a standard chroot config (yum -y install bind-chroot) and no yum
update was available so, I had to run configure to ensure that the
update installed into the correct directory tree (I had to do this
twice though - first installed incorrectly).

Once the update was complete - there were no problems on the secondary
nameserver and I ran it for a week to be sure we didn't encounter any
strange issues. That worked with no problem - so I decided to update
the primary nameserver using the same method. Everything seemed fine,
but when I went to restart rndc - I got the following:

[root at ns1 bind-9.3.5-P1]# rndc reload
rndc: neither /usr//etc/rndc.conf nor /usr//etc/rndc.key was found

Now, I noticed the double slash and realized I likely screwed up in
the configuration option by having a slash that shouldn't be there...
so I changed the configuration and did another make and that got rid
of the double slash, but not the problem. So, another sys admin did
the following:
--------------------
1. /usr/etc/rndc.conf recreated. This is the one that rndc uses.
Removed all
others to avoid confusion.

2. Added teh following to named.conf:
key "rndc-key" {
        algorithm hmac-md5;
        secret "xxxxxxxxxxxxxxxx";
};

3. changed named.conf controls line key to match above:
controls {
        inet 127.0.0.1 allow { localhost; } keys { rndc-key; };
        };

4. Made sure various diretories under chroot had group write perms.
just
compared to original.
-------------------

My assumption is that somehow the update ran under the wrong
permissions and it broke the chroot jail. Now we have our key and bind
running outside chroot. Can I just start over without losing my
settings?

I'm hoping this makes sense to somebody... I'm pretty new to this and
it's not completely clear to me. Any help is appreciated.


More information about the bind-users mailing list