Editing
Problematic Programs
(section)
From Linix VServer
Jump to navigation
Jump to search
Warning:
You are not logged in. Your IP address will be publicly visible if you make any edits. If you
log in
or
create an account
, your edits will be attributed to your username, along with other benefits.
Anti-spam check. Do
not
fill this in!
====AMD 64 Etch Vserver Guest WORKING!!! :o) 21Oct2008'''==== Before I begin with all the grueling steps, if you want to be lazy, I wrote a Perl script to do all of this for you, and you can get it [http://compampus.com/bind9-vserver-installer.pl here]. :*Note: ::If you plan to use the script, you need to ensure you have Perl5, as well as have your locale set properly. ::(On a brand-new Etch guest, I had to do those before my script would work) :I noticed after much googling that all links I found to any of the pre-compiled Bind9 (in the above bind9-capacheck directories) are DEAD. However, after many times of running into a brick wall, I caught something that isn't mentioned here... Following the above steps to build Bind9 from source acquired with apt-get, if you look closely, on about line 499 or so after you execute the dpkg-buildpackage command, you'll see this: <pre> dpkg-source: building bind9 using existing bind9_9.3.4.orig.tar.gz dpkg-source: building bind9 in bind9_9.3.4-2etch3.diff.gz dpkg-source: building bind9 in bind9_9.3.4-2etch3.dsc </pre> :...which is basically ignoring the debian/rules modifications you just made... So, following you will find the steps I took to make Bind9 AND rndc run flawlessly on my vserver guest. Everything denoted with // in front is a comment: <pre> su - cd /usr/src mkdir bind9-build cd !$ apt-get build-dep bind9 apt-get source bind9 mkdir unused mv bind9_* !$ //note the ones you don't need all have the underscore _ cd bind9-x.x.x //whatever your version # is nano debian/rules beneath this line: ./configure --prefix=/usr \ -add --disable-linux-caps \ -change --enable-threads \ to: --disable-threads \ dpkg-buildpackage cd ../ dpkg -i *deb //This will install all the debs that were created, but the actual bind9 deb will fail because of dependencies //At this point, you can just run it again, or 'apt-get install -f' might fix it, but I'm unsure on that dpkg -i *deb echo "bind9 hold" | dpkg --set-selections </pre> :Here you will still see it fail to start, and even though it says that, it isn't named that failed, but only rndc. :So actually, you can stop here, but rndc will fail every time, and bind won't restart with the /etc/init.d/bind9 restart call :In fact, everytime you want to reload, you'll need to manually kill the named process ID and then issue: :/etc/init.d/bind9 start :But if you're a perfectionist like me, and you want a completely error-free starting Bind9 with working rndc, keep reading... <pre> ps aux|grep named </pre> :That will show an output something like: <pre>bind 9376 0.0 0.3 20844 3228 ? Ss 15:52 0:00 /usr/sbin/named -u bind</pre> :Assuming the above was your actual output, your next command would be: <pre> kill 9376 //Kill the process ID </pre> :Now here's where the trickery comes in... :For some reason, if you have the EXACT same key definitions in all the correct places, but the conf files aren't using the actual key file, rndc WILL fail... :Let me say that again... rndc WILL fail... I only know because it took me 3 days to find out why it was failing... :So first: <pre> rndc-confgen -s your.eth0.ip.address -k your-custom-keyname </pre> :Assuming my eth0 IP is 11.22.33.44 and I used a keyname of my-vps-key, the following would be my output: <pre> vps:~# rndc-confgen -s 11.22.33.44 -k my-vps-key # Start of rndc.conf key "my-vps-key" { algorithm hmac-md5; secret "D4fZPZPFpG037a/NHLedgg=="; }; options { default-key "my-vps-key"; default-server 11.22.33.44; default-port 953; }; # End of rndc.conf # Use with the following in named.conf, adjusting the allow list as needed: # key "my-vps-key" { # algorithm hmac-md5; # secret "D4fZPZPFpG037a/NHLedgg=="; # }; # # controls { # inet 11.22.33.44 port 953 # allow { 11.22.33.44; } keys { "my-vps-key"; }; # }; # End of named.conf </pre> :Now, this information is VERY important, and misleading at the same time... :Don't simply plop the 'named.conf' data into named.conf and the 'rndc.conf' data into rndc.conf... It will NOT work. :The 'key' portion is all you need for your keyfile, and your keyfile MUST be named the same as the name you put into rndc-confgen :There are several ways to do this, but the simplest is to highlight the key section, right click, click 'copy' and then: <pre> nano /etc/bind/my-vps-key //Don't forget, name must match the rdnc-confgen output! </pre> :Inside nano, hit shift+insert on your keyboard, and it *should* paste everything properly. Hit ctrl+x to exit nano (press y at the prompt to save). :Once complete, you can verify your key file with: <pre> cat /etc/bind/my-vps-key </pre> :...and the output should read something like: <pre> vps:~# cat /etc/bind/my-vps-key key "my-vps-key" { algorithm hmac-md5; secret "D4fZPZPFpG037a/NHLedgg=="; }; </pre> :Now, do the same thing for the 'options' section of the rndc-confgen output, except you'll be adding that to the rndc.conf file, along with an include statement for the key file you just made. :NOTE: Delete all lines in rndc.conf first so that it contains only what you paste. (ctrl+k will cut lines... cut all of them before pasting) :After pasting, your ENTIRE rndc.conf file should look thusly: <pre> include "/etc/bind/my-vps-key"; options { default-key "my-vps-key"; default-server 11.22.33.44; default-port 953; }; </pre> :Finally, you need to do the same process, but with the 'controls' section of the rndc-confgen output, and that goes in /etc/named.conf. Again, you will need to add the include statement for the key you created. :Also, while you're editing named.conf, you might as well go ahead and edit the IP addresses. The only one that really seems to matter is the 'localhost' zone :When finished, your named.conf should look something like this (only showing the relevant portions) :;Be sure to remove the comment tags (#) from the beginning of the lines!!! <pre> <snip> // If you are just adding zones, please do that in /etc/bind/named.conf.local include "/etc/bind/named.conf.options"; include "/etc/bind/my-vps-key"; controls { inet 11.22.33.44 port 953 allow { 11.22.33.44; } keys { "my-vps-key"; }; }; zone "." { type hint; file "/etc/bind/db.root"; }; // be authoritative for the localhost forward and reverse zones, and for // broadcast zones as per RFC 1912 zone "11.22.33.44" { type master; file "/etc/bind/db.local"; }; zone "127.in-addr.arpa" { <snip> </pre> :I'm unsure if this next step is necessary, but I did it anyway... :Edit /etc/bind/db.local and modify all instances of 'localhost' and '127.0.0.1' with your IP address. :When complete, it should look something like this: <pre> vps:~# cat /etc/bind/db.local ; ; BIND data file for local loopback interface ; $TTL 604800 @ IN SOA 11.22.33.44. root.11.22.33.44. ( 1 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL ; @ IN NS 11.22.33.44. @ IN A 11.22.33.44 </pre> :All that's left is to start your new error-free Bind9 (we hope...) <pre> /etc/init.d/bind9 start </pre> <br /> If you find anything in this tutorial OR in the Perl script that's incorrect, or that would make it better, please let me know: [mailto:paul@grandesigns.net?Subject=VServer_Bind9_Tutorial paul@grandesigns.net] <br><hr> =====Update (11/04/08)...===== After an apt-get dist-upgrade, bind9 failed to start. After poking around, I found out that somehow /etc/default/bind had the -u switch set to run Bind9 as the user 'named'. Weird, because with Bind9, there is no user 'named'. I set it back to: -u bind and everything fired right up. Also, my particular vserver doesn't log to dmesg, so if you want intuitive debug level info that isn't being printed in /var/log/syslog, then you can run named like this: <pre> named -g -d 10 </pre> That tells named to start with the debug level globally set to 10. <br><br> I also tinkered a little more and found that you can remove all of the db. files in /etc/bind and in /etc/bind/named.conf except for db.local and db.root. In other words, you don't need to configure or keep db.0, db.127, db.255, db.empty, nor do you need them referenced in named.conf. <br><br> <hr> ''Problems getting this to work in an x86_64 vserver. Any hints? From what I can tell from stracing, turning off threads doesn't fix everything related to it. It also caused a juicy Ksymoops.'' ''- Apparently this does work when running bind as user root. I Installed a bare Debian Etch vserver without granting any special capabilities on my x86_64 system, apt-get install bind9, kill any started named-processes and edit /etc/default/bind, changing the user (-u) from bind to root. Bind starts now starts when using /etc/init.d/bind9 start and resolving seems to work. Mind you, the usual warnings and rants about running stuff as root still applies! - 2007-08-06 MGS''
Summary:
Please note that all contributions to Linix VServer may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see
Linix VServer:Copyrights
for details).
Do not submit copyrighted work without permission!
Cancel
Editing help
(opens in new window)
Navigation menu
Page actions
Page
Discussion
Read
Edit
History
Page actions
Page
Discussion
More
Tools
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
About
Overview
Paper
News
Developers
Donations
Search
Getting Started
Downloads
FAQs
Documentation
Support
Participate
How to participate
Report a Bug
Communicate
Teams/Projects
Hall of Fame
Resources
Archives
Recent Wiki Changes
Pastebin
Related Projects
VServer Hosting
Happy VServer Users
Tools
What links here
Related changes
Special pages
Page information