<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Hi John,</span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"> Thanks... checking the syslog show me a permission issue on the rndc.key...</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"> it was bind:bind, I change it to root:bind and it works successfully now, and I don't have the 53 port issue...</div>
<div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
Many THanks John for making me check the obvious lol ;))</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
Regards,</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Thomas.</div><br><div class="gmail_quote">On Thu, Oct 4, 2012 at 6:00 PM, John Miller <span dir="ltr"><<a href="mailto:johnmill@brandeis.edu" target="_blank">johnmill@brandeis.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Thomas,<br>
<br>
Since this is Ubuntu, what does /var/log/syslog have to say about the matter? Do you have any specific configuration for rndc controls, or are you primarily using the stock Ubuntu named.conf.local and named.conf.options?<br>
<br>
John<div><div class="h5"><br>
<br>
On 10/04/2012 11:27 AM, Thomas Manson wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Hi,<br>
<br>
I had to change of server because the previous was getting old, and I<br>
had to do it very fast because of a mis-communication of my host...<br>
<br>
I'm on Ubuntu 12.04 server, x86_64.<br>
<br>
root@ns0:/etc/bind# aptitude show bind9<br>
Package: bind9<br>
New: yes<br>
State: installed<br>
Automatically installed: no<br>
Version: 1:9.8.1.dfsg.P1-4ubuntu0.3<br>
<br>
<br>
since then I've some trouble :<br>
<br>
* I've a RNDC error on stopping the service :<br>
<br>
root@ns0:/etc/bind# service bind9 start<br>
* Starting domain name service... bind9<br>
...done.<br>
root@ns0:/etc/bind# service bind9 status<br>
* bind9 is running<br>
root@ns0:/etc/bind# service bind9 stop<br>
* Stopping domain name service... bind9<br>
rndc: connect failed: 127.0.0.1#953: connection refused<br>
waiting for pid 28560 to die<br>
...done.<br>
<br>
and it appears that nothing listen on port 953 :<br>
<br>
root@ns0:/etc/bind# netstat -a | grep 953<br>
unix 2 [ ACC ] STREAM LISTENING 9853953 private/anvil<br>
root@ns0:/etc/bind#<br>
<br>
<br>
When I perform a zonecheck on one of my domain, I get an error saying<br>
that the server do not listen :<br>
<br>
<br>
The server do not listen or answer on the port TCP 53: (translated from<br>
french)<br>
<br></div></div>
* Réf: /IETF RFC1035 (p.32 4.2. Transport)<br>
<<a href="ftp://ftp.ietf.org/rfc/rfc1035.txt" target="_blank">ftp://ftp.ietf.org/rfc/<u></u>rfc1035.txt</a>>/<div class="im"><br>
<br>
The DNS assumes that messages will be transmitted as datagrams or in<br>
a byte stream carried by a virtual circuit. While virtual circuits<br>
can be used for any DNS activity, datagrams are preferred for<br>
queries due to their lower overhead and better performance.<br>
<br>
<br>
while the port is open, checked from another machine :<br>
<br>
thomas@home:/home/special/www$ sudo nmap 88.190.17.222 -sS -p 53<br>
<br>
Starting Nmap 5.21 ( <a href="http://nmap.org" target="_blank">http://nmap.org</a> ) at 2012-10-04 14:55 CEST<br></div>
Nmap scan report for <a href="http://ns0.ordiworld.fr" target="_blank">ns0.ordiworld.fr</a> <<a href="http://ns0.ordiworld.fr" target="_blank">http://ns0.ordiworld.fr</a>><div class="im"><br>
(88.190.17.222)<br>
Host is up (0.023s latency).<br>
PORT STATE SERVICE<br>
53/tcp open domain<br>
<br>
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds<br>
thomas@home:/home/special/www$<br>
thomas@home:/home/special/www$<br>
thomas@home:/home/special/www$<br>
thomas@home:/home/special/www$ telnet <a href="http://ns0.ordiworld.fr" target="_blank">ns0.ordiworld.fr</a><br></div>
<<a href="http://ns0.ordiworld.fr" target="_blank">http://ns0.ordiworld.fr</a>> 53<br>
Trying 88.190.17.222...<br>
Connected to <a href="http://ns0.ordiworld.fr" target="_blank">ns0.ordiworld.fr</a> <<a href="http://ns0.ordiworld.fr" target="_blank">http://ns0.ordiworld.fr</a>>.<div><div class="h5"><br>
Escape character is '^]'.<br>
<br>
<br>
coucou<br>
Connection closed by foreign host.<br>
<br>
<br>
One time, after adding a log cagtegory, the zonecheck was performed with<br>
success, without the port 53 errors, but after a restart, the error<br>
appears again !<br>
<br>
I've 474 domain names... Bind is running with the root account.<br>
<br>
I've increased the max open file (soft and hard limit) to 65535, (by<br>
editing /etc/security/limits.conf and running ulimit -n 65535 from root<br>
prompt and restart bind)<br>
<br>
I would appreciate any help, I'm really lost here...<br>
<br>
<br>
<br>
I've set some logging option but don't see errors in the produced files :<br>
<br>
##############################<u></u>############################""<br>
//include "/etc/bind/zones.rfc1918";<br>
logging {<br>
channel security_file {<br>
file "/var/log/named/security.log" versions 3 size 30m;<br>
severity dynamic;<br>
print-time yes;<br>
};<br>
category security {<br>
security_file;<br>
};<br>
<br>
<br>
channel query.log {<br>
file "/var/log/named/query.log";<br>
severity debug 3;<br>
};<br>
category queries { query.log; };<br>
<br>
<br>
channel config.log {<br>
file "/var/log/named/config.log";<br>
severity debug 3;<br>
};<br>
category config { config.log; };<br>
<br>
<br>
<br>
channel general.log {<br>
file "/var/log/named/general.log";<br>
severity debug 3;<br>
};<br>
category general { general.log; };<br>
<br>
<br>
channel default.log {<br>
file "/var/log/named/default.log";<br>
severity debug 3;<br>
};<br>
category default { default.log; };<br>
<br>
channel resolver.log {<br>
file "/var/log/named/resolver.log";<br>
severity debug 3;<br>
};<br>
category resolver { resolver.log; };<br>
<br>
<br>
channel network.log {<br>
file "/var/log/named/network.log";<br>
severity debug 3;<br>
};<br>
category network { network.log; };<br>
<br>
};<br>
##############################<u></u>############################""<br>
<br>
<br>
<br>
<br>
<br>
/etc/resolv.conf :<br>
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by<br>
resolvconf(8)<br>
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN<br>
nameserver 127.0.0.1<br>
nameserver 88.191.254.60<br>
nameserver 88.191.254.70<br>
<br>
<br>
my /etc/hosts file (for the netstat error) :<br>
<br>
root@ns0:/etc/bind# cat /etc/hosts<br>
127.0.0.1 localhost localhost.localdomain<br>
<br></div></div>
88.190.17.222 <a href="http://ns0.ordiworld.fr" target="_blank">ns0.ordiworld.fr</a> <<a href="http://ns0.ordiworld.fr" target="_blank">http://ns0.ordiworld.fr</a>> ns0<br>
<a href="http://sd-28447.dedibox.fr" target="_blank">sd-28447.dedibox.fr</a> <<a href="http://sd-28447.dedibox.fr" target="_blank">http://sd-28447.dedibox.fr</a>> sd-28447<div class="im"><br>
2a01:e0b:1000:17:be30:5bff:<u></u>fed0:2bd <a href="http://ns0.ordiworld.fr" target="_blank">ns0.ordiworld.fr</a><br></div>
<<a href="http://ns0.ordiworld.fr" target="_blank">http://ns0.ordiworld.fr</a>> ns0 <a href="http://sd-28447.dedibox.fr" target="_blank">sd-28447.dedibox.fr</a><br>
<<a href="http://sd-28447.dedibox.fr" target="_blank">http://sd-28447.dedibox.fr</a>> sd-28447<div class="im"><br>
<br>
# The following lines are desirable for IPv6 capable hosts<br>
::1 localhost ip6-localhost ip6-loopback<br>
fe00::0 ip6-localnet<br>
ff00::0 ip6-mcastprefix<br>
ff02::1 ip6-allnodes<br>
ff02::2 ip6-allrouters<br>
ff02::3 ip6-allhosts<br>
<br>
<br>
<br></div>
______________________________<u></u>_________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/<u></u>listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/<u></u>listinfo/bind-users</a><br>
<br>
</blockquote>
______________________________<u></u>_________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/<u></u>listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/<u></u>listinfo/bind-users</a><br>
</blockquote></div><br>