Can't start BIND9 | Lab 6.1. Configure Caching DNS

cdgmachado

Hi guys,

I'm having a problem when starting BIND9 using sudo systemctl start bind9. I get a random error and when I examine it with sudo systemctl status bind9, I get this:

bind9.service: Failed with result 'exit-code'.
Failed to start BIND Domain Name Server.
bind9.service: Schedule restart job, restart counter is at 20.
Stopped BIND Domain Name Server.
bind9.service: Start request repeated too quickly.

I set DefaultStartLimitIntervalSec and DefaultStartLimitBurst to 40s and 20 respectively on /etc/systemd/system.conf, so I know it's not because the start requests are coming too quickly.

This is what the logs on /var/log/kern.log show but I'm new to Linux so I don't know how to recognize and solve the error based on that:

...apparmor="ALLOWED" operation="open profile="named" name="/proc/cmdline" pid=8226 comm="named" requested_mask="r" denied_mas="r" fsuid=0 ouid=0

...apparmor="ALLOWED" operation="open profile="named" name="/proc/sys/kernel/osrelease" pid=8232 comm="named" requested_mask="r" denied_mas="r" fsuid=0 ouid=0

And this is is my /etc/systemd/system/bind9.service file:

[Unit]
Description=BIND Domain Name Server
Documentation=man:named(8)
After=network.target
Wants=nss-lookup.target
Before=nss-lookup.target

[Service]
Type=forking
EnvironmentFile=-/etc/default/named
ExecStart=/usr/sbin/named $OPTIONS
ExecReload=/usr/sbin/rndc reload
ExecStop=/usr/sbin/rndc stop
Restart=on-failure

[Install]
WantedBy=multi-user.target
Alias=bind9.service

Any help would be very much appreciated!

Thanks!

lee42x

Several ideas, but we are in uncharted territory. We support the long term releases, like Ubuntu 20.04, so testing on your version is not complete. We also have VM's for Ubuntu and others that we recommend; available to download from the Linux Foundation. The best sudgestion is for you to keep your existing VM for now and download and try our Ubuntu 20.04 VM, details are at: https://training.linuxfoundation.org/cm/prep/ near the bottom of the page.
Regards Lee

lee42x

The "network unreachable" is an IPv6 issue, The complete message is something like this:

Notice the addresses that start with 2001:5

Our internal networks are IPv4 only so we can instruct bind to not use IPv6 by adding an option to the default bind configuration file /etc/default/named. The option to be added is "-4" . Image included.

After restarting the service the IPv6 entries should be gone.

Catch up to here then we can look at the serverfail message, please include the entire output. Here is a copy of my "dig" command:

Lee

luisviveropena

But I say that I half-solved it because it works only when my VPN is off. When it's enabled, the dig query fails with a Unable to fetch DNSKEY error on status bind9

Note: it seems I had Carlos in the today's LFS211 Office Hours, and we fixed the issue related to the VPN (we changed the VM's network configuration from NAT to bridged).

Regards,
Luis.

cdgmachado

EDIT: Taking as a guidance the denied_mask=r from the logs, I added to the named profile on apparmor (/etc/apparmor.d/usr.sbin.named), the two path from the errors with the masks where they were denied for (r):

/proc/cmdline as @{PROC}/cmdline r
/proc/sys/kernel/osrelease as @{PROC}/sys/kernel/osrelease r

And now the error that I get in the logs is:

...appamor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="syslog-ng" pid=9486 common="apparmor_parser"

And stopping or disabling apparmor with sudo systemctl stop|disable apparmor doesn't solve the issue either.

(In case I wasn't supposed to do this modification, please let me know and I'll revert the changes)

lee42x

Thank you for letting us know you encountered a difficulty. A couple quick things, are you using one of the Linux Foundation virtual machines or your own install? The lab is designed and tested without Apparmor or SELinux,

lee42x

I might sudgest un-installing Apparmor initially so we can focus on the dns server.

Lee

cdgmachado

Thanks for the answer, @lee42x !

I uninstalled apparmor, checked that it was properly uninstalled, and restarted Ubuntu, but I still get the same error about requests being repeated too quickly, and this time I don't get any error logs to examine on /var/log/kern.log

cdgmachado

And I installed my own version of Ubuntu 21.10 on an Oracle box VM

cdgmachado

Any ideas? @lee42x

coop

As an aside, we do not support Ubuntu 21.04. So thanks for helping to figure out the future needs, but this is a testing release of Ubuntu and exactly how they mucked things up is not a priority to figure out IMHO

cdgmachado

Thank you, Lee!

That worked.

cdgmachado

Hey @lee42x ,

I'm still having issues.

I downloaded and installed LF's VM like you advised from that link, then just added the config from Lab 6.1 to /etc/bind/named.conf.options but I'm getting SERVFAIL on every DNS query to the server.

I found just another post on the forum from another person with this issue where his problem was the firewall but I don't have firewalld enabled (like I mentioned, the only thing I did was to add the options to the named conf file)

I'm getting also network unreachable on systemctl status bind9

cdgmachado

cdgmachado

Hey @lee42x ,

I'm still having issues.

I had to remove LF's VM since it hanged after some minutes of using it pretty much every time. I reinstalled it four times, decreasing RAM to 1024M (I had 2048M before), increasing CPU processors to 2 from 1, enabling/disabling 3D Acceleration but always hanged, and it only happened with this specific VM and not with the others.

So I downloaded 20.4.3 LTS from Ubuntu's site and this is the new error I'm getting:

I know it's related to this file but my current knowledge doesn't allow me to understand what the problem is:

I found these two closed issues on the problem, but again, my current skillset is low to understand the solution:

https://gitlab.isc.org/isc-projects/bind9/-/issues/2769
https://gitlab.isc.org/isc-projects/bind9/-/issues/2728

Thanks again for your help, Lee.

cdgmachado

I half-solved it.

I had to add some extra options on /etc/bind/named.conf.options:

dnssec-enable no;
dnssec-lookaside auto;

And deleted both /var/cache/bind/managed-keys.bind and /var/cache/bind/managed-keys.bind.jnl.When I restarted bind, these two files got auto-created but with a key inserted within KEYDATA which wasn't there before.

But I say that I half-solved it because it works only when my VPN is off. When it's enabled, the dig query fails with a Unable to fetch DNSKEY error on status bind9

How can I make queries while having a VPN enabled?

cdgmachado

I have a typo on my first new post that I can't edit. I meant Ubuntu 20.04.3 LTS

cdgmachado

Correct! Your solution worked like a charm.

Thanks again for your help, Luis.

Cheers!

cdgmachado

And for anyone referencing this thread in the future, I removed the options from below since they were prompting some deprecated warnings on systemctl status bind9:

dnssec-enable no;
dnssec-lookaside auto;

cdgmachado

Thank you also for your input, @coop.

Very much appreciated!