我在Debian Lenny上设置了绑定bind9的域,充当我的DNS主机提供商服务器的奴隶。 确切的情况是我认为不相关的,但我已经允许在我的注册商/ DNS主机的networking接口传输到我的服务器的IP。 这是在我的/etc/bind/named.conf.local中:
zone "wanners.net" in{ type slave; file "/etc/bind/zones/slave.wanners.net.db"; masters {64.68.200.91;}; };
在提到的path中有一个空文件。 我在启动bind9后在/ etc / log / syslog中看到了这个:
Jan 23 22:09:46 wanners named[14828]: starting BIND 9.6-ESV-R3 -u bind Jan 23 22:09:46 wanners named[14828]: built with '--prefix=/usr' '--build=arm-linux-gnueabi' '--host=arm-linux-gnueabi' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var/run/bind' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-dlz-postgres=no' '--with-dlz-mysql=no' '--with-dlz-bdb=yes' '--with-dlz-filesystem=yes' '--with-dlz-ldap=yes' '--with-dlz-stub=yes' '--enable-ipv6' 'build_alias=arm-linux-gnueabi' 'host_alias=arm-linux-gnueabi' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -DNS_RUN_PID_DIR=0 -O2' 'LDFLAGS=' 'CPPFLAGS=' Jan 23 22:09:46 wanners named[14828]: adjusted limit on open files from 1024 to 1048576 Jan 23 22:09:46 wanners named[14828]: found 1 CPU, using 1 worker thread Jan 23 22:09:46 wanners named[14828]: using up to 4096 sockets Jan 23 22:09:46 wanners named[14828]: loading configuration from '/etc/bind/named.conf' Jan 23 22:09:46 wanners named[14828]: using default UDP/IPv4 port range: [1024, 65535] Jan 23 22:09:46 wanners named[14828]: using default UDP/IPv6 port range: [1024, 65535] Jan 23 22:09:46 wanners named[14828]: listening on IPv6 interfaces, port 53 Jan 23 22:09:46 wanners named[14828]: listening on IPv4 interface lo, 127.0.0.1#53 Jan 23 22:09:46 wanners named[14828]: listening on IPv4 interface eth0, 192.168.1.1#53 Jan 23 22:09:46 wanners named[14828]: listening on IPv4 interface eth1, 68.226.67.198#53 Jan 23 22:09:46 wanners named[14828]: listening on IPv4 interface tun0, 10.8.0.1#53 Jan 23 22:09:46 wanners named[14828]: automatic empty zone: 254.169.IN-ADDR.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: 2.0.192.IN-ADDR.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: 255.255.255.255.IN-ADDR.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: DFIP6.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: 8.EFIP6.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: 9.EFIP6.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: AEFIP6.ARPA Jan 23 22:09:46 wanners named[14828]: automatic empty zone: BEFIP6.ARPA Jan 23 22:09:46 wanners named[14828]: command channel listening on 127.0.0.1#953 Jan 23 22:09:46 wanners named[14828]: command channel listening on ::1#953 Jan 23 22:09:46 wanners named[14828]: zone 0.in-addr.arpa/IN: loaded serial 1 Jan 23 22:09:46 wanners named[14828]: zone 127.in-addr.arpa/IN: loaded serial 1 Jan 23 22:09:46 wanners named[14828]: zone 1.168.192.in-addr.arpa/IN: loaded serial 1 Jan 23 22:09:46 wanners named[14828]: zone 255.in-addr.arpa/IN: loaded serial 1 Jan 23 22:09:46 wanners named[14828]: zone lo/IN: loaded serial 1 Jan 23 22:09:46 wanners named[14828]: zone localhost/IN: loaded serial 2 Jan 23 22:09:46 wanners named[14828]: zone wanners.net/IN: has 0 SOA records Jan 23 22:09:46 wanners named[14828]: zone wanners.net/IN: has no NS records Jan 23 22:09:46 wanners named[14828]: running Jan 23 22:09:46 wanners named[14828]: zone wanners.net/IN: Transfer started. Jan 23 22:09:46 wanners named[14828]: transfer of 'wanners.net/IN' from 64.68.200.91#53: connected using 68.226.67.198#51368 Jan 23 22:09:46 wanners named[14828]: dumping master file: /etc/bind/zones/tmp-dysZfOWkDE: open: permission denied Jan 23 22:09:46 wanners named[14828]: transfer of 'wanners.net/IN' from 64.68.200.91#53: failed while receiving responses: permission denied Jan 23 22:09:46 wanners named[14828]: transfer of 'wanners.net/IN' from 64.68.200.91#53: Transfer completed: 0 messages, 13 records, 0 bytes, 0.130 secs (0 bytes/sec) [snip cronjobs] Jan 23 22:10:45 wanners named[14828]: zone wanners.net/IN: Transfer started. Jan 23 22:10:45 wanners named[14828]: transfer of 'wanners.net/IN' from 64.68.200.91#53: connected using 68.226.67.198#42435 Jan 23 22:10:45 wanners named[14828]: dumping master file: /etc/bind/zones/tmp-lWrePAOaFH: open: permission denied Jan 23 22:10:45 wanners named[14828]: transfer of 'wanners.net/IN' from 64.68.200.91#53: failed while receiving responses: permission denied Jan 23 22:10:45 wanners named[14828]: transfer of 'wanners.net/IN' from 64.68.200.91#53: Transfer completed: 0 messages, 13 records, 0 bytes, 0.107 secs (0 bytes/sec)
所以它得到的logging很好,甚至刷新他们; 这只是不回答有关他们的疑问。 为什么是这样? 我该怎么办才能解决这个问题? 并挖掘certificate这一点:
marcus@wanners ~ $ dig -6 wanners.net ; <<>> DiG 9.6-ESV-R3 <<>> -6 wanners.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33846 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;wanners.net. IN A ;; Query time: 2 msec ;; SERVER: ::1#53(::1) ;; WHEN: Sun Jan 23 22:18:46 2011 ;; MSG SIZE rcvd: 29
[我在testing中使用IPv6,因为服务器将在IPv6上提供服务。 对于wanners.net或子域名下的任何logging,即使从外部查询,结果也是一样的]
将/ etc / bind / zones /文件夹的所有权更改为BIND用户的所有权。 绑定无法写入该目录。
1月23日22时09分46秒wanders命名[14828]:转移'wanners.net/IN'从64.68.200.91#53:连接使用68.226.67.198#51368
1月23日22:09:46 wanders命名[14828]:转储主文件:/ etc / bind / zones / tmp-dysZfOWkDE:open:permission denied
1月23日22时09分46秒wanders命名[14828]:转移'wanners.net/IN'从64.68.200.91#53:接收回应失败:权限被拒绝
在我的情况下,所有的权限都是正确的,我甚至在目录上做了一个restorecon,但只有当selinux被允许或禁用时才能工作。
我从bugzilla 545128find的解决scheme是
setsebool -P named_write_master_zones=1
更改可用的权限并不是解决此问题的最佳解决scheme。
该问题是由文件语句中的绝对path创build的….
file "/etc/bind/zones/slave.wanners.net.db";
将其更改为基本文件名称
file "slave.wanners.net.db";
然后绑定将文件写入/ var / cache / bind,它具有正确的权限,以及存储临时文件和工作文件的位置。
有关完整的细节,请参阅https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=209022