On Friday 25 September 2009 11:21:41 Tom Horsley wrote:
I recently enabled dynamic DNS for the virtual machines I've
been installing and named started getting errors (running
as chroot) trying to write .jnl files to the /var/named
directory under the chroot. Fixing the directory to
be root:named 770 instead of root:named 750 took care of
that.
Then with the recent update of bind and bind-chroot, I started
seeing these messages in the log:
Sep 25 08:03:21 zooty named[12710]: dumping master file: tmp-PDw9vymVVL:
open: permission denied
I'm not sure what directory it is trying to write those
in, but I found and chmodded a few more directories
and haven't seen one of those messages since.
Should directory permissions be adjusted in one or more
of the rpms to take these things into account?
1. Don't turn selinux off on your local name-server system ... it actually
works fine with bind/named.
2. You really do not need to run chroot'ed if you have selinux enabled.
However, it will run fine and with selinux -- this will give you an "belt and
suspenders" solution for named security.
3. As currently implemented on Fedora 11, dynamic updates (by dhcpd I assume)
need to have your "database" files in either a "dynamic" or a
"slaves"
subdirectory of the "named" directory (either one will work).
4. Then, in the zone definitions in the named.conf file, you need to point to
the subdirectory with something like:
file "dynamic/lcl.db";
rather than:
file "lcl.db";
Gene