<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><span>Alan,</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16.363636016845703px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span><br></span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16.363636016845703px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">None of the files you listed (bind.keys, managed-keys.bind and managed-keys.bind.jnl)<span style="background-color: transparent;"> are in the bind installation directory, or the chroot that named is run in. I did add the following line in the named.conf file :</span></div><div style="font-family: 'times new roman', 'new york', times, serif;
font-size: 16.363636016845703px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><br></div><div style="background-color: transparent;">managed-keys-directory "/var/log"; <br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">where /var/log is a writable directory for the userid named is run as. Re-hit the process with a kill -1 name.pid and the same errors are in the log file</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color:
transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">also touched blank managed-keys.bind and managed-keys.bind.jnl files in /var/log then re-hit the process with the same results. </div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new
roman', 'new york', times, serif; font-style: normal;">When I change the database directory to an OS writable directory in named.conf with this line in the options block:</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent;">directory "/var/log/namedb"; // Directory where data files are stored<br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">the errors do not show up in the logs, but the database files are
now writable to the OS. Note user permissions are set so the database files in /var/log/namedb and the/var/log/namedb directory is read only for the userid named is run as.</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">Did I use the correct syntax for the managed-keys-directory options line, or is the problem there is not bind.keys file with the managed-keys statements? </div><div style="background-color: transparent; color: rgb(0, 0, 0);
font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16.363636016845703px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> </div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;">*****The content of this message is my personal opinion only, and should not be construed as anything that has been through rigorous scrutiny of the professional groups who devote their life and work to the topics being discussed********</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><br></div> <div style="font-family: 'times
new roman', 'new york', times, serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Alan Clegg <alan@clegg.com><br> <b><span style="font-weight: bold;">To:</span></b> mm half <mm_half3@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "bind-users@lists.isc.org" <bind-users@lists.isc.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, August 28, 2013 1:34 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: bind configuration/setup question<br> </font> </div> <div class="y_msg_container"><br><br>On Aug 28, 2013, at 1:29 PM, Alan Clegg <<a ymailto="mailto:alan@clegg.com" href="mailto:alan@clegg.com">alan@clegg.com</a>> wrote:<br>> <br>> I believe that what you are seeing is the result of BIND 9.9 doing
more things "automatically", including bringing in a set of DNSSEC trust anchors (root and DLV) and not being able to create the file.<br>> <br>> You should be able to use the option "bindkeys-file" to set a location that is writable for this file.<br><br>And as soon as I sent this I realized that I'd goofed. bind.keys is created on install (it is part of the problem, however).<br><br>This file contains "managed-keys" statements that I refer to below (and it was supposed to be "keystore" not "keystone" -- spellcheck will be the death of the computer industry).<br><br>> It's also going to happen if you use managed-keys, as there is a "keystone" created that needs to be updated. See the "managed-keys-directory" option.<br><br>This is where the problem lies. The fact that you have managed-keys requires BIND to create a journal of updates made to the trust-anchor material. Set "managed-keys-directory" to a writable directory
and copy the managed-keys.bind and managed-keys.bind.jnl files there.<br><br>AlanC<br>-- <br>Alan Clegg | +1-919-355-8851 | <a ymailto="mailto:alan@clegg.com" href="mailto:alan@clegg.com">alan@clegg.com</a><br><br><br></div> </div> </div> </div></body></html>