<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class=""><br class="">
</div>
Hi Borja,
<div class=""><br class="">
</div>
<div class="">Many thanks for this hint. I tried to allow with </div>
<div class="">
<div style="margin: 0px; font-stretch: normal; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">setcap 'CAP_NET_BIND_SERVICE=+eip' /usr/local/sbin/named</span></div>
</div>
<div class="">but it didn’t help. </div>
<div class=""><br class="">
</div>
<div class="">On other hand there is no issue on port 53 and 953. Why should it be just on port 853 ? </div>
<div class=""><br class="">
</div>
<div class="">Kind regards </div>
<div class="">Hans </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 21.03.2022, at 15:26, Borja Marcos <<a href="mailto:borjam@sarenet.es" class="">borjam@sarenet.es</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class=""><br class="">
<br class="">
<blockquote type="cite" class="">On 21 Mar 2022, at 14:51, MAYER Hans <<a href="mailto:Hans.Mayer@iiasa.ac.at" class="">Hans.Mayer@iiasa.ac.at</a>> wrote:<br class="">
<br class="">
<br class="">
Looking at the log I see: <br class="">
network: error: creating TLS socket: permission denied<br class="">
<br class="">
Why doesn’t named have the permissions after a „rndc reload“ but it has the permissions after a start ? And why on one server but not on another ?
<br class="">
In both cases the daemon is running as user „bind“ with UID below 128 but not as root.
<br class="">
</blockquote>
<br class="">
Because it usually starts as root and it demotes itself to “bind” whenever possible.<br class="">
<br class="">
Maybe there is a mechanism in Linux to grant permission to a certain UID to bind() a socket to certain privileged
<br class="">
port number, as it is used for NTP on FreeBSD?<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
Borja.<br class="">
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><br class="Apple-interchange-newline">
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 21.03.2022, at 14:51, MAYER Hans <<a href="mailto:Hans.Mayer@iiasa.ac.at" class="">Hans.Mayer@iiasa.ac.at</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class=""><br class="">
<br class="">
Dear All, <br class="">
<br class="">
now BIND 9.18 is supporting DoT directly I tried to go away from a solution with stunnel4 and therefore I compiled 9.18.1 and modified named.conf<br class="">
So far everything is working fine. All the tests with dig , openssl and lsof is showing it’s working. <br class="">
The problem: when I run a „rndc reload“ the named process is not listen on 853/tcp anymore. All tests with TLS fail. And this on IPv4 as well on IPv6.<br class="">
The rest of BIND is working well. Still listening on port 53 on UDP and TCP <br class="">
When I restart the service so that named stops and a new process is started and running then DoT is working again. <br class="">
I run this on Debian 10 buster. <br class="">
The interesting story is I run the same version 9.18.1 on a different Debian 10 buster server. On this server the process „named" survives a „rndc reload“ on port 853 <br class="">
<br class="">
Looking at the log I see: <br class="">
network: error: creating TLS socket: permission denied<br class="">
<br class="">
Why doesn’t named have the permissions after a „rndc reload“ but it has the permissions after a start ? And why on one server but not on another ? <br class="">
In both cases the daemon is running as user „bind“ with UID below 128 but not as root. <br class="">
<br class="">
Any ideas where to look ? <br class="">
<br class="">
Kind regards <br class="">
Hans <br class="">
<br class="">
— <br class="">
<br class="">
<br class="">
maybe the important part of the config<br class="">
<br class="">
listen-on {<br class="">
my.ipv4.hiding.here ;<br class="">
127.0.0.1 ;<br class="">
};<br class="">
listen-on port 853 tls iiasaatls { any; }; <br class="">
listen-on-v6 { any ; } ;<br class="">
listen-on-v6 port 853 tls iiasaatls { any; }; <br class="">
<br class="">
<br class="">
</div>
</blockquote>
<br class="">
</div>
</div>
<div><br class="">
</div>
</body>
</html>