0

I am running Ubuntu 18.04.2 and BIND 9.11.3

I am trying to enable logging by adding the following to /etc/bind/named.conf.local

logging {
channel bind.log {
    file "/var/log/bind/bind.log" versions 3 size 20m;
    print-time yes;
    print-category yes;
    print-severity yes;
    // Set the severity to dynamic to see all the debug messages.
    severity info;
};

category default { bind.log; };
};

"named-checkconf /etc/bind/named.conf.local" does not report any errors. However when I do:

root@mail:/home/mike# service bind9 restart
root@mail:/home/mike# service bind9 status

I get:

bind9.service - BIND Domain Name Server
   Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sat 2019-07-06 18:48:43 NZST; 2s ago
     Docs: man:named(8)
  Process: 9812 ExecStop=/usr/sbin/rndc stop (code=exited, status=0/SUCCESS)
  Process: 12930 ExecStart=/usr/sbin/named -f $OPTIONS (code=exited, status=1/FAILURE)
 Main PID: 12930 (code=exited, status=1/FAILURE)

Jul 06 18:48:43 mail.mydomain.nz named[12930]: automatic empty zone: A.E.F.IP6.ARPA
Jul 06 18:48:43 mail.mydomain.nz named[12930]: automatic empty zone: B.E.F.IP6.ARPA
Jul 06 18:48:43 mail.mydomain.nz named[12930]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
Jul 06 18:48:43 mail.mydomain.nz named[12930]: automatic empty zone: EMPTY.AS112.ARPA
Jul 06 18:48:43 mail.mydomain.nz named[12930]: none:103: 'max-cache-size 90%' - setting to 7086MB (out of 7874MB)
Jul 06 18:48:43 mail.mydomain.nz named[12930]: command channel listening on 127.0.0.1#953
Jul 06 18:48:43 mail.mydomain.nz named[12930]: isc_stdio_open '/var/log/bind/bind.log' failed: permission denied
Jul 06 18:48:43 mail.mydomain.nz named[12930]: configuring logging: permission denied
Jul 06 18:48:43 mail.mydomain.nz named[12930]: loading configuration: permission denied
Jul 06 18:48:43 mail.mydomain.nz named[12930]: exiting (due to fatal error)

The permissions of /var/log/bind are:

root@mail:/home/mike# ls -ld /var/log/bind
drwxrwxr-x 2 root root 4096 Jul  6 17:51 /var/log/bind

This post here said

isc_stdio_open '/var/log/bind9/query.log' failed: permission denied

"bind:bind" works but I couldn't follow that. Is that a reference to the directory being owned by a user named "bind" and belonging to the "bind" group? I would have commented on that question asking for more info but at least 50 reputation is required.

I noticed this in syslog:

Jul  6 22:30:52 mail kernel: [1835655.620976] audit: type=1400 audit(1562409052.847:297): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/log/bind/bind.log" pid=10582 comm="isc-worker0000" requested_mask="ac" denied_mask="ac" fsuid=120 ouid=0
0

In /etc/apparmor.d/usr.sbin.named

I changed

# some people like to put logs in /var/log/named/ instead of having
# syslog do the heavy lifting.
/var/log/named/** rw,
/var/log/named/ rw,

to

 # some people like to put logs in /var/log/named/ instead of having
 # syslog do the heavy lifting.
 /var/log/bind/** rw,
 /var/log/bind/ rw,

as that was the name of the directory I had specified logs to be written to.

Then

root@mail:/home/mike# service apparmor restart
root@mail:/home/mike# service bind9 restart
root@mail:/home/mike# service bind9 status

All good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.