26 Jul
2010
26 Jul
'10
8:42 p.m.
Hello all,
I'm new to VPS admin, and even more so to DNS, so I apologize in advance
if my questions are naive.
I currently have a Bitfolk VPS that rsyncs a zone file to Bitfolk's name
servers. Migrating to a new VPS running Ubuntu 10.04, I understand that
rsyncing is being discouraged in favor of setting up a DNS server of my
own. I'm under the impression that setting up a DNS server will
similarly carry the information in the zone file to Bitfolks servers,
but I'm unfamiliar with how this process works. I've look at the Ubuntu
documentation for bind9, but I'm not sure if I need a caching server, a
DNS primary, or a DNS secondary.
Can anyone who's done this give me some pointers?
26 Jul
26 Jul
8:51 p.m.
Hi Michael,
I presume by this you mean that Bitfolk host your DNS, but that you
hold the zone file for the DNS. In this case, you need a secondary DNS
server that will host the zone information, but allow the Bitfolk DNS
servers to replicate from.
If that's correct, and you need more help, feel free to give me a shout!
James
On 26 July 2010 21:42, Michael Corliss <michaeljcorliss(a)gmail.com> wrote:
Hello all,
I'm new to VPS admin, and even more so to DNS, so I apologize in advance if
my questions are naive.
I currently have a Bitfolk VPS that rsyncs a zone file to Bitfolk's name
servers. Migrating to a new VPS running Ubuntu 10.04, I understand that
rsyncing is being discouraged in favor of setting up a DNS server of my own.
I'm under the impression that setting up a DNS server will similarly carry
the information in the zone file to Bitfolks servers, but I'm unfamiliar
with how this process works. I've look at the Ubuntu documentation for
bind9, but I'm not sure if I need a caching server, a DNS primary, or a DNS
secondary.
Can anyone who's done this give me some pointers?
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
9:02 p.m.
On Mon, July 26, 2010 9:51 pm, James Gregory wrote:
I presume by this you mean that Bitfolk host your DNS,
but that you
hold the zone file for the DNS. In this case, you need a secondary DNS
server that will host the zone information, but allow the Bitfolk DNS
servers to replicate from.
Forgive the pedantry, but in case it helps clarify the situation: As
Michael will be managing/maintaining the zone file he will be the primary
DNS. Bitfolk will be acting as a secondary.
Mathew
27 Jul
27 Jul
2:04 a.m.
Hi Michael,
On Mon, Jul 26, 2010 at 04:42:58PM -0400, Michael Corliss wrote:
I understand that rsyncing is being discouraged in
favor of
setting up a DNS server of my own.
In case anyone was not aware of this, here's why:
When people whose zone files are being rsynced edit their files,
they are supposed to run named-checkzone on them to check that their
zone file is syntactically valid. I don't think very many people do
this, because I frequently end up with a zone file that my
nameserver can't parse. The errors are then only visible to me, so
I have to open a ticket and get people to fix them.
Having the customer run their own nameserver is a much better
solution because they get to immediately see syntax any errors they
might introduce and do not need a back-and-forth with support to
sort them out.
At the time the rsynced zone files solution was in place, the
smallest BitFolk VPS had 120MiB RAM, and it was a reasonable
complaint that running an authoritative DNS server on such a small
VPS was a burden.
For a long time now, 240MiB RAM has been the smallest available in a
BitFolk VPS, and it's really perfectly feasible to run your own
authoritative name server in that. Whether you choose to expose your
own name server to the Internet or only to BitFolk's authoritative
servers is up to you.
So, while I've left all existing rsynced zone files in place, I have
not accepted new ones in that way for a long time. I'm also not keen
to update existing rsync configurations when people migrate to new
VPSes, hence Michael's email.
I'm under the impression that setting up a DNS
server will
similarly carry the information in the zone file to Bitfolks servers, but
I'm unfamiliar with how this process works.
How it works:
When a name server loads a zone, the serial number at the top of the
zone is checked. If the new serial is larger than the old one (or if
the zone is completely new), the name server sends out a DNS NOTIFY
packet to each of the hosts listed as NS records in the zone file.
On receipt of a NOTIFY, these hosts then attempt to make a connect
the source of the NOTIFY and check if they need to transfer the zone
content. This is known as AXFR.
I've look at the Ubuntu documentation for bind9,
but I'm not sure
if I need a caching server, a DNS primary, or a DNS secondary.
The names "primary" and "secondary" can be confusing. There's
basically two kinds of name server:
- a caching resolver, sometimes just called a resolver, or a cache;
and
- an authoritative server, sometimes abbreviated to "auth server".
"primary" and "secondary" are names for authoritative DNS servers
that perform certain roles.
The usual distinction is that a "primary" server gets its zone
content directly from the admin, perhaps in the form of a zone file.
There is only one "primary" server.
"secondary" servers get their zone content from elsewhere, usually
the primary, but really it could be any other authoritative server
i.e. other "secondary" servers!
From the point of view of the DNS client, all authoritative servers
are as good as each other.
You need to set up an authoritative name server; it's going to be
authoritative for the zone(s) you load into it. For bind9, this is
really just a particular configuration. Probably the default one.
bind9 can act as either authoritative or caching resolver (or both
at once, but that's not a recommended configuration).
Can anyone who's done this give me some pointers?
1. Install a name server (bind9 is a good choice if you are
unfamiliar with name servers, because it's the most popular, and
your zone file is already in bind format).
2. Load your existing zone file into it. It shouldn't require any
modification except to increment the serial number at the top.
3. Query your name server to check that it has the records in it
that you expect.
4. Configure your name server to allow AXFR from BitFolk's servers.
Here's the list of servers:
* a.authns.bitfolk.com
* b.authns.bitfolk.com
* c.authns.bitfolk.com
Resolve those names to IPs to put into your config.
5. Contact support(a)bitfolk.com to ask for secondary DNS to be set
up. Please specify the domain name and your VPS account name.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
3 Aug
3 Aug
2:46 p.m.
Part of this process also involves changing the nameservers from
Bitfolks old servers to their new ones. My registrar currently has the
old ones, would it make sense add the three new ones to my zone file,
then have my registrar update to the new ones, and then remove the old
ones? I'm hoping to avoid as much downtime as possible, and there's a
lag between requesting the change from my registrar and the change
actually being made.
Andy Smith wrote:
Hi Michael,
On Mon, Jul 26, 2010 at 04:42:58PM -0400, Michael Corliss wrote:
I understand that rsyncing is being discouraged
in favor of
setting up a DNS server of my own.
In case anyone was not aware of this, here's why:
When people whose zone files are being rsynced edit their files,
they are supposed to run named-checkzone on them to check that their
zone file is syntactically valid. I don't think very many people do
this, because I frequently end up with a zone file that my
nameserver can't parse. The errors are then only visible to me, so
I have to open a ticket and get people to fix them.
Having the customer run their own nameserver is a much better
solution because they get to immediately see syntax any errors they
might introduce and do not need a back-and-forth with support to
sort them out.
At the time the rsynced zone files solution was in place, the
smallest BitFolk VPS had 120MiB RAM, and it was a reasonable
complaint that running an authoritative DNS server on such a small
VPS was a burden.
For a long time now, 240MiB RAM has been the smallest available in a
BitFolk VPS, and it's really perfectly feasible to run your own
authoritative name server in that. Whether you choose to expose your
own name server to the Internet or only to BitFolk's authoritative
servers is up to you.
So, while I've left all existing rsynced zone files in place, I have
not accepted new ones in that way for a long time. I'm also not keen
to update existing rsync configurations when people migrate to new
VPSes, hence Michael's email.
I'm under the impression that setting up a
DNS server will
similarly carry the information in the zone file to Bitfolks servers, but
I'm unfamiliar with how this process works.
How it works:
When a name server loads a zone, the serial number at the top of the
zone is checked. If the new serial is larger than the old one (or if
the zone is completely new), the name server sends out a DNS NOTIFY
packet to each of the hosts listed as NS records in the zone file.
On receipt of a NOTIFY, these hosts then attempt to make a connect
the source of the NOTIFY and check if they need to transfer the zone
content. This is known as AXFR.
I've look at the Ubuntu documentation for
bind9, but I'm not sure
if I need a caching server, a DNS primary, or a DNS secondary.
The names "primary" and "secondary" can be confusing.
There's
basically two kinds of name server:
- a caching resolver, sometimes just called a resolver, or a cache;
and
- an authoritative server, sometimes abbreviated to "auth server".
"primary" and "secondary" are names for authoritative DNS servers
that perform certain roles.
The usual distinction is that a "primary" server gets its zone
content directly from the admin, perhaps in the form of a zone file.
There is only one "primary" server.
"secondary" servers get their zone content from elsewhere, usually
the primary, but really it could be any other authoritative server
i.e. other "secondary" servers!
From the point of view of the DNS client, all authoritative servers
are as good as each other.
You need to set up an authoritative name server; it's going to be
authoritative for the zone(s) you load into it. For bind9, this is
really just a particular configuration. Probably the default one.
bind9 can act as either authoritative or caching resolver (or both
at once, but that's not a recommended configuration).
Can anyone who's done this give me some
pointers?
1. Install a name server (bind9 is a good choice if you are
unfamiliar with name servers, because it's the most popular, and
your zone file is already in bind format).
2. Load your existing zone file into it. It shouldn't require any
modification except to increment the serial number at the top.
3. Query your name server to check that it has the records in it
that you expect.
4. Configure your name server to allow AXFR from BitFolk's servers.
Here's the list of servers:
* a.authns.bitfolk.com
* b.authns.bitfolk.com
* c.authns.bitfolk.com
Resolve those names to IPs to put into your config.
5. Contact support(a)bitfolk.com to ask for secondary DNS to be set
up. Please specify the domain name and your VPS account name.
Cheers,
Andy
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
4 Aug
4 Aug
8:31 a.m.
Hi Michael,
The old nameserver names have been working for years and I expect
them to continue to work for years to come, so I would rank changing
them as a very low priority for you. Basically get everything else
working first is my advice.
Since you are currently in a known-working state, you can avoid
problems by setting up the new DNS server and querying it to check
that it has the records you expect. *Only then* would you instruct
BitFolk to get your zone from your new server rather than your
current one.
Cheers,
Andy
On Tue, Aug 03, 2010 at 10:46:30AM -0400, Michael Corliss wrote:
Part of this process also involves changing the
nameservers from Bitfolks
old servers to their new ones. My registrar currently has the old ones,
would it make sense add the three new ones to my zone file, then have my
registrar update to the new ones, and then remove the old ones? I'm
hoping to avoid as much downtime as possible, and there's a lag between
requesting the change from my registrar and the change actually being
made.
--
http://bitfolk.com/ -- No-nonsense VPS hosting
6 Aug
6 Aug
7:12 p.m.
I can't tell if it's running properly. When I run 'named -g -p 53', I
get the following:
06-Aug-2010 18:59:22.781 found 1 CPU, using 1 worker thread
06-Aug-2010 18:59:22.781 using up to 4096 sockets
06-Aug-2010 18:59:22.785 loading configuration from
'/etc/bind/named.conf'
06-Aug-2010 18:59:22.786 reading built-in trusted keys from file
'/etc/bind/bind.keys'
06-Aug-2010 18:59:22.786 max open files (1024) is smaller than max
sockets (4096)
06-Aug-2010 18:59:22.786 using default UDP/IPv4 port range: [1024,
65535]
06-Aug-2010 18:59:22.787 using default UDP/IPv6 port range: [1024,
65535]
06-Aug-2010 18:59:22.788 listening on IPv6 interfaces, port 53
06-Aug-2010 18:59:22.788 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.788 listening on all IPv6 interfaces failed
06-Aug-2010 18:59:22.788 listening on IPv4 interface lo, 127.0.0.1#53
06-Aug-2010 18:59:22.788 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.788 creating IPv4 interface lo failed;
interface ignored
06-Aug-2010 18:59:22.788 listening on IPv4 interface eth0,
212.13.195.254#53
06-Aug-2010 18:59:22.789 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.789 creating IPv4 interface eth0 failed;
interface ignored
06-Aug-2010 18:59:22.789 not listening on any interfaces
06-Aug-2010 18:59:22.789 could not open file
'/var/run/named/named.pid': Permission denied
06-Aug-2010 18:59:22.789 generating session key for dynamic DNS
06-Aug-2010 18:59:22.789 could not open file
'/var/run/named/session.key': Permission denied
06-Aug-2010 18:59:22.789 could not create /var/run/named/session.key
06-Aug-2010 18:59:22.789 failed to generate session key for dynamic
DNS: permission denied
06-Aug-2010 18:59:22.791 automatic empty zone: 254.169.IN-ADDR.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: 2.0.192.IN-ADDR.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone:
255.255.255.255.IN-ADDR.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone:
0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone:
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: D.F.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: 8.E.F.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: 9.E.F.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: A.E.F.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: B.E.F.IP6.ARPA
06-Aug-2010 18:59:22.794 none:0: open: /etc/bind/rndc.key:
permission denied
06-Aug-2010 18:59:22.794 couldn't add command channel 127.0.0.1#953:
permission denied
06-Aug-2010 18:59:22.794 none:0: open: /etc/bind/rndc.key:
permission denied
06-Aug-2010 18:59:22.794 couldn't add command channel ::1#953:
permission denied
06-Aug-2010 18:59:22.794 the working directory is not writable
06-Aug-2010 18:59:22.794 ignoring config file logging statement due
to -g option
06-Aug-2010 18:59:22.795 listening on IPv6 interfaces, port 53
06-Aug-2010 18:59:22.795 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.795 listening on all IPv6 interfaces failed
06-Aug-2010 18:59:22.795 additionally listening on IPv4 interface
lo, 127.0.0.1#53
06-Aug-2010 18:59:22.795 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.795 creating IPv4 interface lo failed;
interface ignored
06-Aug-2010 18:59:22.795 additionally listening on IPv4 interface
eth0, 212.13.195.254#53
06-Aug-2010 18:59:22.795 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.795 creating IPv4 interface eth0 failed;
interface ignored
06-Aug-2010 18:59:22.795 zone 0.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 18:59:22.796 zone 127.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 18:59:22.796 zone 255.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 18:59:22.797 zone ilovephilosophy.com/IN: loaded serial
2010080601
06-Aug-2010 18:59:22.797 zone localhost/IN: loaded serial 2
06-Aug-2010 18:59:22.798 running
06-Aug-2010 18:59:22.798 zone ilovephilosophy.com/IN: sending
notifies (serial 2010080601)
...
There are a number of "permission denied", "failed..." and "could
not..." lines, which I'm guessing are bad. I thought it might be
iptables blocking the port, but I fixed my rules and even tried flushing
the rules to see if that would do it, to no avail. All the files it's
claiming not to have permission for are owned by root and the group bind.
Andy Smith wrote:
Hi Michael,
The old nameserver names have been working for years and I expect
them to continue to work for years to come, so I would rank changing
them as a very low priority for you. Basically get everything else
working first is my advice.
Since you are currently in a known-working state, you can avoid
problems by setting up the new DNS server and querying it to check
that it has the records you expect. *Only then* would you instruct
BitFolk to get your zone from your new server rather than your
current one.
Cheers,
Andy
On Tue, Aug 03, 2010 at 10:46:30AM -0400, Michael Corliss wrote:
Part of this process also involves changing the
nameservers from Bitfolks
old servers to their new ones. My registrar currently has the old ones,
would it make sense add the three new ones to my zone file, then have my
registrar update to the new ones, and then remove the old ones? I'm
hoping to avoid as much downtime as possible, and there's a lag between
requesting the change from my registrar and the change actually being
made.
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
8:36 p.m.
OK, I solved the permissions problem. Mostly it was using sudo (hehe,
*blush*), but I also had to change the owner of rndc.key to root.
Out but is as follows, does this mean it worked?
06-Aug-2010 20:33:59.053 starting BIND 9.7.0-P1 -g -p 53
06-Aug-2010 20:33:59.053 built with '--prefix=/usr'
'--mandir=/usr/share/man' '--infodir=/usr/share/info'
'--sysconfdir=/etc/bind' '--localstatedir=/var'
'--enable-threads'
'--enable-largefile' '--with-libtool' '--enable-shared'
'--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr'
'--with-gnu-ld' '--with-dlz-postgres=no'
'--with-dlz-mysql=no'
'--with-dlz-bdb=yes' '--with-dlz-filesystem=yes'
'--with-dlz-ldap=yes' '--with-dlz-stub=yes'
'--with-geoip=/usr'
'--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2'
'LDFLAGS=-Wl,-Bsymbolic-functions' 'CPPFLAGS='
06-Aug-2010 20:33:59.053 adjusted limit on open files from 1024 to
1048576
06-Aug-2010 20:33:59.053 found 1 CPU, using 1 worker thread
06-Aug-2010 20:33:59.053 using up to 4096 sockets
06-Aug-2010 20:33:59.058 loading configuration from
'/etc/bind/named.conf'
06-Aug-2010 20:33:59.058 reading built-in trusted keys from file
'/etc/bind/bind.keys'
06-Aug-2010 20:33:59.059 using default UDP/IPv4 port range: [1024,
65535]
06-Aug-2010 20:33:59.059 using default UDP/IPv6 port range: [1024,
65535]
06-Aug-2010 20:33:59.060 listening on IPv6 interfaces, port 53
06-Aug-2010 20:33:59.061 listening on IPv4 interface lo, 127.0.0.1#53
06-Aug-2010 20:33:59.061 listening on IPv4 interface eth0,
212.13.195.254#53
06-Aug-2010 20:33:59.062 generating session key for dynamic DNS
06-Aug-2010 20:33:59.065 automatic empty zone: 254.169.IN-ADDR.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: 2.0.192.IN-ADDR.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone:
255.255.255.255.IN-ADDR.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone:
0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone:
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: D.F.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: 8.E.F.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: 9.E.F.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: A.E.F.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: B.E.F.IP6.ARPA
06-Aug-2010 20:33:59.068 command channel listening on 127.0.0.1#953
06-Aug-2010 20:33:59.068 command channel listening on ::1#953
06-Aug-2010 20:33:59.068 ignoring config file logging statement due
to -g option
06-Aug-2010 20:33:59.069 zone 0.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 20:33:59.069 zone 127.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 20:33:59.070 zone 255.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 20:33:59.071 zone ilovephilosophy.com/IN: loaded serial
2010080601
06-Aug-2010 20:33:59.071 zone localhost/IN: loaded serial 2
06-Aug-2010 20:33:59.072 running
06-Aug-2010 20:33:59.072 zone ilovephilosophy.com/IN: sending
notifies (serial 2010080601)
06-Aug-2010 20:34:02.467 success resolving 'sou.nameserver.net/A'
(in 'nameserver.net'?) after reducing the advertised EDNS UDP packet
size to 512 octets
Michael Corliss wrote:
I can't tell if it's running properly. When I
run 'named -g -p 53', I
get the following:
06-Aug-2010 18:59:22.781 found 1 CPU, using 1 worker thread
06-Aug-2010 18:59:22.781 using up to 4096 sockets
06-Aug-2010 18:59:22.785 loading configuration from
'/etc/bind/named.conf'
06-Aug-2010 18:59:22.786 reading built-in trusted keys from file
'/etc/bind/bind.keys'
06-Aug-2010 18:59:22.786 max open files (1024) is smaller than max
sockets (4096)
06-Aug-2010 18:59:22.786 using default UDP/IPv4 port range: [1024,
65535]
06-Aug-2010 18:59:22.787 using default UDP/IPv6 port range: [1024,
65535]
06-Aug-2010 18:59:22.788 listening on IPv6 interfaces, port 53
06-Aug-2010 18:59:22.788 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.788 listening on all IPv6 interfaces failed
06-Aug-2010 18:59:22.788 listening on IPv4 interface lo, 127.0.0.1#53
06-Aug-2010 18:59:22.788 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.788 creating IPv4 interface lo failed;
interface ignored
06-Aug-2010 18:59:22.788 listening on IPv4 interface eth0,
212.13.195.254#53
06-Aug-2010 18:59:22.789 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.789 creating IPv4 interface eth0 failed;
interface ignored
06-Aug-2010 18:59:22.789 not listening on any interfaces
06-Aug-2010 18:59:22.789 could not open file
'/var/run/named/named.pid': Permission denied
06-Aug-2010 18:59:22.789 generating session key for dynamic DNS
06-Aug-2010 18:59:22.789 could not open file
'/var/run/named/session.key': Permission denied
06-Aug-2010 18:59:22.789 could not create /var/run/named/session.key
06-Aug-2010 18:59:22.789 failed to generate session key for dynamic
DNS: permission denied
06-Aug-2010 18:59:22.791 automatic empty zone: 254.169.IN-ADDR.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: 2.0.192.IN-ADDR.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone:
255.255.255.255.IN-ADDR.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone:
0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone:
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: D.F.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: 8.E.F.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: 9.E.F.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: A.E.F.IP6.ARPA
06-Aug-2010 18:59:22.791 automatic empty zone: B.E.F.IP6.ARPA
06-Aug-2010 18:59:22.794 none:0: open: /etc/bind/rndc.key:
permission denied
06-Aug-2010 18:59:22.794 couldn't add command channel 127.0.0.1#953:
permission denied
06-Aug-2010 18:59:22.794 none:0: open: /etc/bind/rndc.key:
permission denied
06-Aug-2010 18:59:22.794 couldn't add command channel ::1#953:
permission denied
06-Aug-2010 18:59:22.794 the working directory is not writable
06-Aug-2010 18:59:22.794 ignoring config file logging statement due
to -g option
06-Aug-2010 18:59:22.795 listening on IPv6 interfaces, port 53
06-Aug-2010 18:59:22.795 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.795 listening on all IPv6 interfaces failed
06-Aug-2010 18:59:22.795 additionally listening on IPv4 interface
lo, 127.0.0.1#53
06-Aug-2010 18:59:22.795 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.795 creating IPv4 interface lo failed;
interface ignored
06-Aug-2010 18:59:22.795 additionally listening on IPv4 interface
eth0, 212.13.195.254#53
06-Aug-2010 18:59:22.795 could not listen on UDP socket: permission
denied
06-Aug-2010 18:59:22.795 creating IPv4 interface eth0 failed;
interface ignored
06-Aug-2010 18:59:22.795 zone 0.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 18:59:22.796 zone 127.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 18:59:22.796 zone 255.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 18:59:22.797 zone ilovephilosophy.com/IN: loaded serial
2010080601
06-Aug-2010 18:59:22.797 zone localhost/IN: loaded serial 2
06-Aug-2010 18:59:22.798 running
06-Aug-2010 18:59:22.798 zone ilovephilosophy.com/IN: sending
notifies (serial 2010080601)
...
There are a number of "permission denied", "failed..." and
"could
not..." lines, which I'm guessing are bad. I thought it might be
iptables blocking the port, but I fixed my rules and even tried
flushing the rules to see if that would do it, to no avail. All the
files it's claiming not to have permission for are owned by root and
the group bind.
Andy Smith wrote:
> Hi Michael,
>
> The old nameserver names have been working for years and I expect
> them to continue to work for years to come, so I would rank changing
> them as a very low priority for you. Basically get everything else
> working first is my advice.
>
> Since you are currently in a known-working state, you can avoid
> problems by setting up the new DNS server and querying it to check
> that it has the records you expect. *Only then* would you instruct
> BitFolk to get your zone from your new server rather than your
> current one.
>
> Cheers,
> Andy
>
> On Tue, Aug 03, 2010 at 10:46:30AM -0400, Michael Corliss wrote:
>> Part of this process also involves changing the nameservers from
>> Bitfolks
>> old servers to their new ones. My registrar currently has the old
>> ones,
>> would it make sense add the three new ones to my zone file, then
>> have my
>> registrar update to the new ones, and then remove the old ones? I'm
>> hoping to avoid as much downtime as possible, and there's a lag between
>> requesting the change from my registrar and the change actually being
>> made.
>
>
> _______________________________________________
> users mailing list
> users(a)lists.bitfolk.com
> https://lists.bitfolk.com/mailman/listinfo/users
7 Aug
7 Aug
5:58 a.m.
Hi Michael,
It looks OK. I would just start it normally and query it.
Cheers,
Andy
On Fri, Aug 06, 2010 at 04:36:21PM -0400, Michael Corliss wrote:
OK, I solved the permissions problem. Mostly it was
using sudo (hehe,
*blush*), but I also had to change the owner of rndc.key to root.
Out but is as follows, does this mean it worked?
06-Aug-2010 20:33:59.053 starting BIND 9.7.0-P1 -g -p 53
06-Aug-2010 20:33:59.053 built with '--prefix=/usr'
'--mandir=/usr/share/man' '--infodir=/usr/share/info'
'--sysconfdir=/etc/bind' '--localstatedir=/var'
'--enable-threads'
'--enable-largefile' '--with-libtool' '--enable-shared'
'--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr'
'--with-gnu-ld' '--with-dlz-postgres=no'
'--with-dlz-mysql=no'
'--with-dlz-bdb=yes' '--with-dlz-filesystem=yes'
'--with-dlz-ldap=yes' '--with-dlz-stub=yes'
'--with-geoip=/usr'
'--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2'
'LDFLAGS=-Wl,-Bsymbolic-functions' 'CPPFLAGS='
06-Aug-2010 20:33:59.053 adjusted limit on open files from 1024 to
1048576
06-Aug-2010 20:33:59.053 found 1 CPU, using 1 worker thread
06-Aug-2010 20:33:59.053 using up to 4096 sockets
06-Aug-2010 20:33:59.058 loading configuration from
'/etc/bind/named.conf'
06-Aug-2010 20:33:59.058 reading built-in trusted keys from file
'/etc/bind/bind.keys'
06-Aug-2010 20:33:59.059 using default UDP/IPv4 port range: [1024,
65535]
06-Aug-2010 20:33:59.059 using default UDP/IPv6 port range: [1024,
65535]
06-Aug-2010 20:33:59.060 listening on IPv6 interfaces, port 53
06-Aug-2010 20:33:59.061 listening on IPv4 interface lo, 127.0.0.1#53
06-Aug-2010 20:33:59.061 listening on IPv4 interface eth0,
212.13.195.254#53
06-Aug-2010 20:33:59.062 generating session key for dynamic DNS
06-Aug-2010 20:33:59.065 automatic empty zone: 254.169.IN-ADDR.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: 2.0.192.IN-ADDR.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone:
255.255.255.255.IN-ADDR.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone:
0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone:
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: D.F.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: 8.E.F.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: 9.E.F.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: A.E.F.IP6.ARPA
06-Aug-2010 20:33:59.065 automatic empty zone: B.E.F.IP6.ARPA
06-Aug-2010 20:33:59.068 command channel listening on 127.0.0.1#953
06-Aug-2010 20:33:59.068 command channel listening on ::1#953
06-Aug-2010 20:33:59.068 ignoring config file logging statement due
to -g option
06-Aug-2010 20:33:59.069 zone 0.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 20:33:59.069 zone 127.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 20:33:59.070 zone 255.in-addr.arpa/IN: loaded serial 1
06-Aug-2010 20:33:59.071 zone ilovephilosophy.com/IN: loaded serial
2010080601
06-Aug-2010 20:33:59.071 zone localhost/IN: loaded serial 2
06-Aug-2010 20:33:59.072 running
06-Aug-2010 20:33:59.072 zone ilovephilosophy.com/IN: sending
notifies (serial 2010080601)
06-Aug-2010 20:34:02.467 success resolving 'sou.nameserver.net/A'
(in 'nameserver.net'?) after reducing the advertised EDNS UDP packet
size to 512 octets
--
http://bitfolk.com/ -- No-nonsense VPS hosting
5011
days inactive
5023
days old
8 comments
4 participants
participants (4)
-
Andy Smith -
James Gregory -
Mathew Newton -
Michael Corliss