Bind9 zone permission denied!

Hello!

My problem all DNS:

/home/apple-1/conf/dns/apple.hu.db failed: permission denied
/home/example-1/conf/dns/example.com.db failed: permission denied
etc…

It could be a few days. Because I noticed that I wanted to change the name server on one of the domains that had been modified for 2 weeks, so it was still good then. Since then, the server has not even been accessed in ssh.

Premissions:
/home/apple-1/conf/dns/apple.hu.db 640 root:bind
/home/example-1/conf/dns/example.com.db 640 root:bind

What could be the problem? In the past, these were rights, then there was no problem with him.
This is a problem with all hosting. (all users)

Users arent able to access or modify any files in /home/conf/* by design, this isnt a bug nor an issue.

aug 16 16:24:48 server1.myserver.hu named[453]: zone apple.hu/IN: loading from master file /home/apple-1/conf/dns/apple-1.hu.db failed: permission denied
aug 16 16:24:48 server1.myserver.hu named[453]: zone apple.hu/IN: not loaded due to errors.
aug 16 16:24:48 server1.myserver.hu named[453]: zone example.com/IN: loading from master file /home/example-1/conf/dns/example.com.db failed: permission denied
aug 16 16:24:48 server1.myserver.hu named[453]: zone example.com/IN: not loaded due to errors.
aug 16 16:24:48 server1.myserver.hu named[453]: all zones loaded
aug 16 16:24:48 server1.myserver.hu named[453]: running
aug 16 16:24:48 server1.myserver.hu named[453]: zone 127.in-addr

and does not load them because the domain check throws an error on it.

M-PRIF -E- [apple.hu] Cannot get domain data (ns1.myserver.hu: myserv_ip)

Can you run a v-rebuild-user for every user and check, if it fixes the issue?

don’t fix :frowning:
I tried, but unfortunately not good still.

what do the permisions of the folder higher up look like?
/home
/home/{user}
/home/{user}/conf
/home/{user}/conf/dns

most likely you are missing x rights at some level, so named can’t change into the folders.

I still believe you messed up the permissions on your whole system at some point, by blindly running recursive chmod one high-up dir which removed the executable rights from your folders and now you see the outcome on different services.

1 Like

home: 755 root:root
home/apple-1 755 root:root
home/apple-1/conf 755 root:root
home/apple-1/conf/dns 751 root:root
home/apple-1/conf/dns/* 640 root:bind

solved:

/etc/apparmor.d/usr.sbin.named Add this line:

/home/** rwm,

Underneath

/etc/bind/** rw,

and service apparmor restart

and working! :)) :slight_smile: thanks.