permissions for DNSSEC zone signing

Mark Andrews marka at isc.org
Tue Jul 23 22:44:34 UTC 2013


In message <51EF00AF.4090204 at networktest.com>, David Newman writes:
> FreeBSD 9.1-RELEASE-p4, BIND 9.9.3-P1 ESV installed from ports
> 
> What are the correct directory and file permissions for DNSSEC static
> zone signing with bind?
> 
> By default, everything in /var/named/etc/namedb is owned by bind except
> for the master directory. For example:
> 
> drwxr-xr-x bind wheel dynamic
> drwxr-xr-x bind bind managed-keys
> drwxr-xr-x root wheel master
> -rw-r--r-- bind wheel named.conf
> -rw-r--r-- bind wheel named.root
> -r--r--r-- bind wheel rndc.conf
> drwxr-xr-x bind wheel slave
> drwxr-xr-x bind wheel working
> 
> Without DNSSEC, this is fine. With DNSSEC enabled, there are permissions
> errors in /var/log/messages after restarting named, because bind can't
> create the jnl/jbk/signed files. For example:
> 
> Jul 23 14:57:16 hostname named[42000]: master/example.org.db.jbk:
> create: permission denied
> 
> Here are the DNSSEC-specific bits from named.conf:
> options {
> 	..
>         managed-keys-directory "/etc/namedb/managed-keys";
>         dnssec-enable yes;
>         dnssec-lookaside auto;
>         dnssec-validation auto;
> 	..
> }
> 
> zone "example.org" {
>         type master;
>         file "master/example.org.db";
>         allow-query { any; };
>         allow-transfer { xfer; };
>         key-directory "/etc/namedb/managed-keys";
>         inline-signing yes;
>         auto-dnssec maintain;
> };
> 
> There is a valid KSK and ZSK for this zone in managed-keys.
> 
> Changing ownership of the master directory results in a complaint when
> restarting named that master wants to be owned by root.

Rename the file to "dynamic/example.org.db" and update named.conf.
The directory "dynamic" has permissions set up for dynamic master files
which this zone is.

> Thanks in advance for clues on sorting out this permissions problem.
> 
> dn
> 
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
>  from this list
> 
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org


More information about the bind-users mailing list