3

I am trying out MAAS but I am having trouble getting the node to reach the internet. This is my setup:

3 physical machine, with 1 of them having two network cards acting as gateway, cluster controllers and region controller. The gateway/controller is setup to have one interface receive IP from the corporate network and while having the other managed by MAAS (both DHCP and DNS.)

From the gateway, I have no problem reaching out, but the Nodes cannot. I looked at the controller/gateway, I can see that bind9 is running.

$ service bind9 status
 * bind9 is running

Doing dig ubuntu.com give me results. But if I do dig @127.0.0.1 ubuntu.com, I get no return. I also look through the bind config and everything seems to be in order (forwarder is setup.) What am I missing?

Here are the relevant bind configs

$ cat /etc/bind/named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

$ cat /etc/bind/named.conf.options
options { directory "/var/cache/bind";
dnssec-validation auto;
include "/etc/bind/maas/named.conf.options.inside.maas";
auth-nxdomain no;
listen-on-v6 { any; }; };

$ cat /etc/bind/maas/named.conf.options.inside.maas 
    forwarders {
        172.24.3.136;
    };
1
  • Further investigation I found this error from /var/log/syslog Oct 15 18:00:14 OpenStackProtoRegionMaster named[25021]: validating @0x7ffe08181cc0: . NS: got insecure response; parent indicates it should be secure
    – Kenny Ho
    Oct 16, 2014 at 18:44

2 Answers 2

4

Looks like the "got insecure response" is the issue. Found this solution from StackOverflow: https://stackoverflow.com/a/14923549/1692452

This is related to the new DNSSEC feature which is now enabled by default. This might indicate the DNS resolvers/forwarders you are using does not support DNSSEC so the response appear to be insecure to your server.

You can either use resolvers that support DNSSEC or temporarily disable the feature on your server. To disable it, simply use those parameters in your “named.conf” :

dnssec-enable no; dnssec-validation no;

0

Beside dnssec issues reported in the OP's answer (no valid RRSIG resolving ...), I also had issues with IPv6, which manifested themselves like so:

maas1 named[1532]: network unreachable resolving './NS/IN': 2001:503:c27::2:30#53

The solution was to start bind9 in v4 mode only. To achieve this, I leveraged this article (I'm using MAAS 2.1 on Xenial, which is running systemd):

  1. sudo systemctl cat bind9.service | grep ExecStart. This provides the current cmdline used to start the bind9 daemon.
  2. sudo systemctl edit bind9.service. An empty editor appears which allows overriding the required aspects of the service definition.
  3. Add the -4 flag to the ExecStart cmdline noted previously at save the file. In my case it looks like this:

    [Service]
    ExecStart=
    ExecStart=/usr/sbin/named -4 -f -u bind
    

    (NB: the first blank ExecStart= is intended - refer to the aforementioned article).

  4. If you'd like to check that your override is in place, you can re-run: systemctl cat bind9.service
  5. systemctl restart bind9.service
  6. Run a few requests from nodes and check all is good with: systemctl status bind9.service - previously this was chock full of the errors mentioned above.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .