Questions[rndc](server)

I have been building DNS servers on centos 7 (i inherited the these but need to make changes to repurpose them)

When I run the any rndc command it does not work i.e. when i try rndc reload i get no confirmation if it was successful, do not even get command failed

Please also note that I am using linux namespaces so the typical rndc command has a prefic of 'ip entns exec gi'

If i check /var/log/messages simultaneously i do not get any output as compared to another DNS server.

I have posted the output of the necessary services below:

/usr/lib/systemd/system/named.service

[Unit]
Description=Berkeley Internet Name Domain (DNS)
Wants=nss-lookup.target
Wants=named-setup-rndc.service
Before=nss-lookup.target
After=network.target
After=named-setup-rndc.service

[Service]
Type=forking
Environment=NAMEDCONF=/etc/named.conf
EnvironmentFile=-/etc/sysconfig/named
Environment=KRB5_KTNAME=/etc/named.keytab
PIDFile=/run/named/named.pid

ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'

ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS

ExecReload=/bin/sh -c '/usr/sbin/rndc reload > /dev/null 2>&1 || /bin/kill -HUP $MAINPID'

ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

PrivateTmp=true

[Install]
WantedBy=multi-user.target

/usr/lib/systemd/system/named-setup-rndc.service

[Unit]
Description=Generate rndc key for BIND (DNS)

[Service]
Type=oneshot

ExecStart=/usr/libexec/generate-rndc-key.sh

I have tried to delete the rndc.key file and recreate using the named service but this has not worked. I am really stumped here. Anyone have any experience with this

after named restart the logs

-- Unit named-setup-rndc.service has begun starting up.
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 systemd[1]: Started Generate rndc key for BIND (DNS).
-- Subject: Unit named-setup-rndc.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit named-setup-rndc.service has finished starting up.
-- 
-- The start-up result is done.
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 systemd[1]: Starting Berkeley Internet Name Domain (DNS)...
-- Subject: Unit named.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit named.service has begun starting up.
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: starting BIND 9.9.4-RedHat-9.9.4-74.el7_6.1 -u named -c /etc/named.conf -4
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: built with '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '-
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: ----------------------------------------------------
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: BIND 9 is maintained by Internet Systems Consortium,
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: Inc. (ISC), a non-profit 501(c)(3) public-benefit
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: corporation.  Support and training for BIND 9 are
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: available at https://www.isc.org/support
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: ----------------------------------------------------
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: adjusted limit on open files from 4096 to 1048576
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: found 8 CPUs, using 8 worker threads
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: using 8 UDP listeners per interface
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: using up to 21000 sockets
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: loading configuration from '/etc/named.conf'
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: reading built-in trusted keys from file '/etc/named.root.key'
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: initializing GeoIP Country (IPv4) (type 1) DB
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: GEO-106FREE 20180327 Build 1 Copyright (c) 2018 MaxMind Inc All Rights Reserved
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: initializing GeoIP Country (IPv6) (type 12) DB
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: GEO-106FREE 20180605 Build 1 Copyright (c) 2018 MaxMind Inc All Rights Reserved
Sep 24 14:01:40 DUB1-00-VM-GI_DNS1 named[12637]: GeoIP City (IPv4) (type 2) DB not available

Also i believe the debug logs are setup to be written to /var/named/data/named.run posted output below

tail -f /var/named/data/named.run
all zones loaded
running
shutting down
stopping command channel on 127.0.0.1#953
stopping command channel on ::1#953
no longer listening on 127.0.0.1#53
exiting
managed-keys-zone: loaded serial 1021
all zones loaded
running

just realized after installing bind-9.9.4-P2, there is a ./etc/bind.keys file already installed. I have looked at their explanation here but have no clue what this is for still.

Can someone please let me know if I need to secure this key also by making it only readable by root, similar to how I'd do the same for the rndc.conf file?

The error as shown in the 2 pictures below:

The configurations for named.conf and the zones files as shown below:

Update 1: This is the result after applying the suggestions from "alveso".

The error has been resolved, but I still can't ping my own domain www.p0864868.com (10.0.0.1) nor can I do host or nslookup lookups as shown on previous pictures.

I also attached my the changes that I made to my named.conf as well as my resolve.conf configs as shown below:

Update 2: I turned on logging by typing "rndc querylog" with the output as below when I pinged p0864868.com

Update 3: changed permission of 10-0-0.zone and p086868.zone to 644 named:named Still can't ping www.p0864868.com or execute host command. It says something like Network Unreachable.

I just made some changes to a DNS zone in Webmin and clicked the "Apply Changes" button. I received the error message:

rndc: connection to remote host closed This may indicate that the remote server is using an older version of the command protocol, this host is not authorized to connect, or the key is invalid

How can I troubleshoot / repair this? I copied parts of the BIND config from a failing server, so I suspect that's what causing it...

I would appreciate help on this. I tried myself, see below.

cp 40.129.98.db 40.234.173.db

nano 40.234.173.db

(modified IP in the file to reflect 173 IP, updated SERIAL)

named-checkzone /var/named/40.234.173.db

root@server [/var/named]# rndc reload 40.234.173.in-addr.arpa
rndc: 'reload' failed: not found