<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<title>NYSDS Email Alert — Warning (Bold Variant)</title>
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Proxima Nova";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Xavier, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I believe Danilo Godec has given good advice,</span><span style="font-size:11.0pt"><br>
<br>
Ultimately, rather than updating apparmor, which was an issue at my site, I moved all zone information into /var/bind/* but dynamic and static files.<br>
I did something as well with error messages, but I don’t recall what, currently all log files are under /var/log/named/ don’t recall if that was an apparmor change or I moved the files, perhaps the former but didn’t have any issues bringing up a new DNS primary
without changes, so I may have just been lucky when I’d picked the patch originally.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Arial",sans-serif">Brian
</span></b><b><span style="font-family:"Arial",sans-serif">Cuttler</span></b><o:p></o:p></p>
<p class="MsoNormal"><i><span style="font-size:11.0pt;font-family:"Arial",sans-serif">Pronouns: he, him, his (<a href="https://oer.ny.gov/system/files/documents/2023/11/personal-pronouns.pdf">What’s This</a>?)</span></i><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">System and Network Administration</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#5A336F">Wadsworth Center, New York State Department of Health</span></b><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">Room D280, Biggs Laboratory</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">Empire State Plaza, Albany, NY 12201</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">(518) 486-1697 | <a href="mailto:Brian.Cuttler@health.ny.gov">Brian.Cuttler@health.ny.gov</a></span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="color:#7030A0"><img border="0" width="320" height="75" style="width:3.3333in;height:.7812in" id="Picture_x0020_869070300" src="cid:image001.png@01DD3084.5E653410" alt="Wadsworth Center's logo thumbnail"></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><a href="http://www.wadsworth.org/"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">www.</span><span style="font-family:"Arial",sans-serif">wadsworth</span><span style="font-size:9.0pt;font-family:"Arial",sans-serif">.org</span></a></span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"> <span style="font-size:11.0pt"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> bind-users <bind-users-bounces@lists.isc.org>
<b>On Behalf Of </b>Danilo Godec via bind-users<br>
<b>Sent:</b> Thursday, August 20, 2026 1:48 AM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="border:none;border-left:solid #D6B000 3.0pt;background:#FCE888;padding:12.0pt 15.0pt 12.0pt 15.0pt">
<p class="MsoNormal"><b><span style="font-family:"Proxima Nova";color:#1B1B1B">Attention:</span></b><span style="font-family:"Proxima Nova";color:#1B1B1B"> This email came from an external source. Do not open attachments or click on links from unknown senders
or unexpected emails. <o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'd start by checking if the file <b>/var/named/dynamic/managed-keys.bind.jnl</b> already exists and has the correct ownership and permissions.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If that's OK, you might want to check your audit log (journalctl or /var/log/audit/audit.log), look for "apparmor.*DENIED'.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Also check that your 'named' process is actually running as 'bind' user - on my distribution, it's running as '<b>named</b>':<o:p></o:p></p>
</div>
<pre># ps auwx | grep named<o:p></o:p></pre>
<pre><b>named</b> 19845 0.4 3.2 966932 63832 ? Ssl avg18 11:31 /usr/sbin/named -u named -4<o:p></o:p></pre>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Permission denied is almost certainly a message from the operating system, not from named.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> D.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On 19.08.26 20:43, Xavier Humbert via bind-users wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi, my DNS server is working perfectly, passes all the tests, but I started to notice this in the logs
<br>
<br>
root@aragorn:/var/named# ll /var/named/dynamic/ <br>
total 0 <br>
root@aragorn:/var/named# systemctl restart named <br>
root@aragorn:/var/named# systemctl status named <br>
● named.service - BIND Domain Name Server <br>
Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; preset: enabled)
<br>
Active: active (running) since Wed 2026-08-19 20:30:55 CEST; 3s ago <br>
Docs: <a href="man:named(8)">man:named(8)</a> <br>
Main PID: 178757 (named) <br>
Status: "running" <br>
Tasks: 10 (limit: 2216) <br>
Memory: 25.5M (peak: 26.5M) <br>
CPU: 607ms <br>
CGroup: /system.slice/named.service <br>
└─178757 /usr/sbin/named -f -u bind <br>
<br>
Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started named.service - BIND Domain Name Server.
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.011 general: notice: all zones loaded
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 general: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 general: error: managed-keys-zone: sync_keyzone:dns_journal_open -> unexpected error
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 dnssec: error: managed-keys-zone: unable to synchronize managed keys: unexpected error
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 dnssec: error: failed to initialize managed-keys for view _default (unexpected error): DNSSEC validation is at risk
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending notifies (serial 2026028370)
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.013 general: notice: running
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies (serial 2026010801)
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending notifies (serial 2026010801)
<br>
<br>
<br>
root@aragorn:/var/named# ll -a /var/named/ <br>
total 12 <br>
drwxr-xr-x 3 bind bind 4096 Nov 29 2023 ./ <br>
drwxr-xr-x 16 root root 4096 Dec 24 2024 ../ <br>
drwxr-xr-x 2 bind bind 4096 Nov 29 2023 dynamic/ <br>
<br>
Here are my options : <br>
<br>
options { <br>
listen-on port 53 { 127.0.0.1; any;}; <br>
listen-on-v6 port 53 { ::1; any;}; <br>
listen-on { 127.0.0.1; }; <br>
<br>
directory "/var/named"; <br>
dump-file "/var/named/data/cache_dump.db"; <br>
statistics-file "/var/named/data/named_stats.txt"; <br>
memstatistics-file "/var/named/data/named_mem_stats.txt"; <br>
recursing-file "/var/named/data/named.recursing"; <br>
secroots-file "/var/named/data/named.secroots"; <br>
allow-query { localhost; }; <br>
recursion no; <br>
<br>
managed-keys-directory "/var/named/dynamic"; <br>
<br>
pid-file "/run/named/named.pid"; <br>
session-keyfile "/run/named/session.key"; <br>
<br>
auth-nxdomain no; # conform to RFC1035 <br>
allow-transfer { none; }; <br>
allow-recursion { xavhome; }; <br>
version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial"; <br>
}; <br>
<br>
What is the problem ? Permissions seem OK <br>
<br>
This is an Ubuntu 22.04.4 Server LTS <br>
<br>
Thanks, <br>
<br>
Regards, <br>
<br>
Xavier <o:p></o:p></p>
</blockquote>
<p><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
Lep pozdrav / Best regards,<br>
--<o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666">Danilo Godec</span></b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666"> | Sistemska podpora / System Administration
<o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#ED1C24">AGENDA d.o.o.</span></b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666"> | Ul. Pohorskega bataljona 49, Sl-2000 Maribor
<o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#ED1C24">E:</span></b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666">
<a href="mailto:danilo.godec@agenda.si">danilo.godec@agenda.si </a>| </span><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#ED1C24">T:</span></b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666"> +386 (0)2 421
61 31 <o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:9.0pt 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666"><a href="https://www.agenda.si/">Agenda OpenSystems
</a>| Največji slovenski odprtokodni integrator <o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666"><a href="http://www.redhat.si/">Red Hat v Sloveniji
</a>| Red Hat Premier Business Partner <o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666"><a href="http://elasticbox.eu/">ElasticBox
</a>| Poslovne rešitve v oblaku <o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:16.5pt 0in 16.5pt 0in">
<p class="MsoNormal"><a href="https://www.agenda.si/"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;border:none windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="32" height="32" style="width:.3333in;height:.3333in" id="Picture_x0020_1" src="cid:image002.png@01DD3084.5E653410" alt="Agenda d.o.o."></span></a><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#666666"><a href="https://www.agenda.si/index.php?id=228">Izjava o omejitvi odgovornosti / Legal disclaimer statement
</a><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>