Home / server / Questions / 742351
Accepted
eXe
Asked: 2015-12-11 23:58:29 +0800 CST

rndc delzone {zonename} : permission denied

  • 772

System is:

Debian GNU/Linux 8.2 (jessie)

BIND 9.9.5-9+deb8u3-Debian (Extended Support Version)

named.conf.options:

options {
    directory "/var/cache/bind";
    key-directory "/etc/bind/keys";

    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

    // If your ISP provided one or more IP addresses for stable 
    // nameservers, you probably want to use them as forwarders.  
    // Uncomment the following block, and insert the addresses replacing 
    // the all-0's placeholder.

    // forwarders {
    //  0.0.0.0;
    // };

    //========================================================================
    // If BIND logs error messages about the root key being expired,
    // you will need to update your keys.  See https://www.isc.org/bind-keys
    //========================================================================
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
    dnssec-dnskey-kskonly yes;
    sig-validity-interval 21 16;
    inline-signing yes;

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };

    // permit lookup of unknown dns names
    recursion no;

    // allow dynamicly new zones
    allow-new-zones yes;
};

the cache file /var/cache/bind/3bf305731dd26307.nzf has thr rights 0744 and is owned by bind:bind

everything works as expected, i can add zones, stat, load keys and everything - except:

rndc delzone {ZoneName}

If i trigger this command (as root in console) i get an rndc: 'delzone' failed: permission denied

in the log nothing is showed..

i'm really stuck here - anyone have a clue why this permission error occurs?

permissions

1 Answers

  1. Best Answer

    The Problem was, that i was modifying the original cache file /var/cache/bind/3bf305731dd26307.nzf.

    I removed all entries after rndc addzone to my own file structure which i included in the named.conf. After a rndc reload, when the entry is not any more in the original cache file located, there is no way to delete the zone via rndc delzone. To gain permissions back, the configuration string of the zone file MUST be located in the original cache file /var/cache/bind/3bf305731dd26307.nzf when a rndc reload is triggered. Seems bind has a need for this internal..

    So as the content of /var/cache/bind/3bf305731dd26307.nzf says itself - do not edit this file manually, only via rndc.

    • 0