DNS broken after Fedora 10 upgrade

**woodson2** · 12-03-2008, 02:16 PM

I have a primary and slave DNS server running on my internal LAN for the past 3-4 iterations of Fedora. However after the FC10 upgrade I cannot start the named service....

This is what I see in /var/log/messages

03-Dec-2008 10:07:46.246 starting BIND 9.5.1b2-RedHat-9.5.1-0.8.b2.fc10 -g
03-Dec-2008 10:07:46.246 found 2 CPUs, using 2 worker threads
03-Dec-2008 10:07:46.247 using up to 4096 sockets
03-Dec-2008 10:07:46.252 loading configuration from '/etc/named.conf'
03-Dec-2008 10:07:46.253 max open files (1024) is smaller than max sockets (4096)
03-Dec-2008 10:07:46.254 using default UDP/IPv4 port range: [1024, 65535]
03-Dec-2008 10:07:46.254 using default UDP/IPv6 port range: [1024, 65535]
03-Dec-2008 10:07:46.257 listening on IPv4 interface lo, 127.0.0.1#53
03-Dec-2008 10:07:46.258 listening on IPv4 interface eth0, 10.10.10.100#53
03-Dec-2008 10:07:46.262 default max-cache-size (33554432) applies
03-Dec-2008 10:07:46.262 /etc/named.conf:28: using specific query-source port suppresses port randomization and can be insecure.
03-Dec-2008 10:07:46.263 could not get query source dispatcher (0.0.0.0#53)
03-Dec-2008 10:07:46.263 loading configuration: address in use
03-Dec-2008 10:07:46.263 exiting (due to fatal error)

This is the results of named-checkconf -z

zone maizenblue.com/IN: maizenblue.com/MX 'mail.maizenblue.com' is a CNAME (illegal)
zone maizenblue.com/IN: loaded serial 2007041818
zone 10.10.10.in-addr.arpa/IN: loading from master file 10.10.10.zone failed: file not found
_default/10.10.10.in-addr.arpa/IN: file not found

looks like it can't find the reverse zone file, however it is definitely there....Any help would be greatly appreciated...Thanks

**david250** · 12-04-2008, 06:52 AM

I did quite a bit of searching on the Web. It seems that
configuring BIND securely and correctly is difficult.

All I can offer is a long discussion by Sean Boran here:

http://www.boran.com/security/sp/bind9_20010430.html
Section 4 "Setting Jail Permissions" and

following that may be useful. There is also a list of
refernces at the end of the paper.

P.S.: The paper refers to Solaris OS. Of course
I don't know if it's a Fedora 10 problem, a
configuration or permissions problem, or
something else, or a mixture. But it looks
like a reference with good advice for DNS
and BIND...

hope this helps,

David

**girlygeek** · 12-04-2008, 01:29 PM

It looks like BIND is running already when you tried to start it, or some other application is listening on port 53.

Code:

 
03-Dec-2008 10:07:46.263 loading configuration: address in use

**peter** · 12-04-2008, 01:35 PM

I tried the same thing on my home server. Hmm, what could be wrong?

**peter** · 12-04-2008, 01:39 PM

This is what I was getting in the logs:

Code:

named[31804]: starting BIND 9.5.1b3-RedHat-9.5.1-0.9.b3.fc10 -u named -t /var/named/chroot
named[31804]: found 1 CPU, using 1 worker thread
named[31804]: using up to 4096 sockets
named[31804]: loading configuration from '/etc/named.conf'
named[31804]: /etc/named.conf:30: both "recursion no;" and "allow-recursion" active for view external
named[31804]: max open files (1024) is smaller than max sockets (4096)
named[31804]: using default UDP/IPv4 port range: [1024, 65535]
named[31804]: using default UDP/IPv6 port range: [1024, 65535]
named[31804]: listening on IPv4 interface lo, 127.0.0.1#53
named[31804]: listening on IPv4 interface eth0, 192.168.1.200#53
named[31804]: /etc/named.conf:19: using specific query-source port suppresses port randomization and c
named[31804]: could not get query source dispatcher (0.0.0.0#53)
named[31804]: loading configuration: address in use
named[31804]: exiting (due to fatal error)

I commented out this and it looks like it's working:

Code:

//query-source    port 53;
//query-source-v6 port 53;

Not sure why.

**girlygeek** · 12-04-2008, 01:41 PM

I was looking too.

They removed those statements in the new sample named.conf.

Code:

/var/named/chroot/etc/named.conf.rpmnew

**rkarim1981** · 12-05-2008, 02:12 AM

I always found that what bind configuration files work in fodora 8 it don't work on fedora 9 same here also what work on fedora 9 it don't work fedora 10 because the file missed/syntax cahnged from version to version.

I personally make my own solution as i copied entire chroot folder from old version and depoloyed it in new version and it is working fine. (i.e. need to copy files incl named.ca, named.root, named.root.hints ... etc)

Or, at last I am using djbdns (best dns pkg, i ever found), it is nice, easy, and dont' have the problem like bind.

**pnelsonsr** · 12-11-2008, 04:17 PM

I was running Bind as well as a DHCP server on my Fedora 9 system supporting my Home Network. After dealing with the upgrade to Fedora 10, I checked into dnsmasq as a small footprint solution to both. Works really well so far (only had it configured and working for last 2 days). Might be something to look at. I just got sick of Bind and DHCP apps which were always much bigger of a solution then I needed.