0

I'm facing a serious problem which has knocked out my server.

For some unknown reason, named is no longer working, despite doing my best to remediation the issues found on the logs.

I get this error whenever I try to run the rebuilddnsconfig (cpanel)

warn [fixrndc] /usr/sbin/rndc status failed: rndc: connect failed: 127.0.0.1#953: connection refused

And when I check the status of named:

root@host [/etc]# /etc/init.d/named status
rndc: connect failed: 127.0.0.1#953: connection refused

This is my /var/log/messages tail

root@host [/etc]# tail /var/log/messages
Nov 24 22:32:25 host named[21687]: listening on IPv4 interface eth1, 108.xx.18.18#53
Nov 24 22:32:25 host named[21687]: listening on IPv4 interface eth1:cp1, 108.xx.18.19#53
Nov 24 22:32:25 host named[21687]: listening on IPv4 interface eth1:cp2, 108.xx.18.20#53
Nov 24 22:32:25 host named[21687]: listening on IPv4 interface eth1:cp3, 108.xx.18.21#53
Nov 24 22:32:25 host named[21687]: listening on IPv4 interface eth1:cp4, 108.xx.18.22#53
Nov 24 22:32:25 host named[21687]: listening on IPv4 interface eth1:cp5, 108.xx.18.23#53
Nov 24 22:32:25 host named[21687]: command channel listening on 127.0.0.1#953
Nov 24 22:32:25 host named[21687]: couldn't open pid file '/var/run/named/named.pid': Permission denied
Nov 24 22:32:25 host named[21687]: exiting (due to early fatal error)
Nov 24 22:32:25 host /etc/init.d/named: named startup succeeded

My configs are given these permissions:

root@host [/etc]# ls -lh | grep named.conf
-rw-r--r--  1 named root  4.9K Nov 24 22:11 named.conf

My named.conf has the following code: (minus zones)

include "/etc/rndc.key";

controls {
    inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };
};  

options {
    /* make named use port 53 for the source of all queries, to allow
         * firewalls to block all ports except 53:
         */

    // query-source    port 53;

    recursion no;

    /* We no longer enable this by default as the dns posion exploit
        has forced many providers to open up their firewalls a bit */

    // Put files that named is allowed to write in the data/ directory:
    directory                "/var/named"; // the default
    pid-file                 "/var/run/named/named.pid";
    dump-file                "data/cache_dump.db";
    statistics-file          "data/named_stats.txt";
   /* memstatistics-file     "data/named_mem_stats.txt"; */
    allow-transfer    { "none"; };
};

The permissions on rndc:

root@host [/etc]# ls -lh | grep rndc
-rw-rw----  1 named named  479 Nov 24 21:29 rndc.conf
-rw-rw----  1 named named  479 Nov 24 21:16 rndc.conf.bak
-rw-rw----  1 named named   77 Nov 24 21:29 rndc.key

My Named Folder Permissions:

ls -lh /var/run/named/
total 8.0K
drwxrwxr-x  2 named named 4.0K Jan  7  2013 ./
drwxrwx--- 22 root  root  4.0K Nov 24 22:29 ../

Is there anything that stands out here?

Thanks for your help!

Moe
  • 167
  • 1
  • 1
  • 8
  • Is this the same server that you accidentally moved folders on (or are you just having a really bad day)? All of that looks correct. I'd be looking to check passwd file in case there are multiple conflicting entries for named. – Paul Haldane Nov 25 '14 at 08:14
  • Another possibility is selinux. If it's enabled and enforcing (see sestatus output) then try temporarily switching into permissive mode using setenforce permissive. If that helps then you need to fix the selinux file labels for a permanent fix. – Paul Haldane Nov 25 '14 at 08:39
  • Same Server Paul! :( Very unlucky! I didn't have this problem as soon as I moved everything back, it was working fine. I did, however, notice that there was a pending cPanel Update which I suspect may have caused the problem. – Moe Nov 25 '14 at 08:53
  • passwd only has one entry for named & SELinus is disabled. – Moe Nov 25 '14 at 08:56
  • I keep seeing this error `rndc: connect failed: 127.0.0.1#953` - Do I need to enable something on port 953? – Moe Nov 25 '14 at 09:06
  • 953 is the port used by rndc. That's controlled by the "controls" stanza. It's just another symptom of named not starting. – Paul Haldane Nov 25 '14 at 10:08
  • Try simplifying. Test to see if the user "named" can write to /var/run/named/named.pid. From a root shell do "sudo -u named -s /bin/bash" then in that shell (which is running as named) try "touch /var/run/named/named.pid". If that works, then I'm puzzled (and maybe named isn't configured to run as user named). If it fails then you've got a simpler problem to investigate. – Paul Haldane Nov 25 '14 at 10:11
  • Thanks Paul, I managed to find a work around which was to set the `pid-file` in the named.conf from `/var/run/named/named.pid` to `named.pid`- restarted and everything worked. Can you please answer with your recommendations and I will accept. – Moe Nov 25 '14 at 10:16

1 Answers1

2

It seems clear that the (a) basic issue named's inability to write to its pid file. Possibilities that come to mind are

  1. conflicting entries for named user in passwd file
  2. selinux

Suggestions for how you might test these theories in comments.

Since changing the location of the pid file in named.conf has fixed things it still seems likely that there's an issue with folder permissions under /var/run.

Paul Haldane
  • 4,517
  • 1
  • 21
  • 32
  • I ran `sudo -u named -s /bin/bash` and could `touch name.pid` without any issues. So strange!? – Moe Nov 25 '14 at 13:03
  • OK, so I went to restart named - same issue! But now when I tried to run `sudo -u named -s /bin/bash` and `touch` the file, it didn't work. – Moe Nov 26 '14 at 08:49
  • Ok, I found that the `/var/named/` directory was changed from "named:named" ownership, to `root:named` with `o:r+w` `g:r` permissions - am I supposed to run `named` as root? – Moe Nov 26 '14 at 08:56