Problem with DNS cluster slave: zone files creates as "root"

Thanks Jamie! The suggested change fixed the ownership problem.

Another issue popped up though, which obviously has to do with AppArmor on Ubuntu:

Sep 21 22:44:20 aurora kernel: [32192.974621] type=1400 audit(1348260260.223:38): apparmor="DENIED" operation="link" parent=1 profile="/usr/sbin/named" name="/var/lib/bind/db-wFUYyWmQ" pid=26585 comm="named" requested_mask="l" denied_mask="l" fsuid=107 ouid=107 target="/var/lib/bind/testabc.de.hosts"

This happens just before the zone transfer starts.

Does Virtualmin in general suggest to turn off AppArmor? I have the feeling it causes more problems than it helps preventing. :)

Alrighty, AppArmor is killed, and zone transfer for the fresh zone works now.

Just one thing is still odd: An empty temporary file is left behind in the zone file directory. According to syslog, the empty zone file was renamed before the zone transfer started.

I've created a lot of zones under Ubuntu 10.04 using the cluster slave thingy, and this never happened. :) Should Webmin be creating an empty zone file at all when a new zone is made through cluster slave?

I'm attaching the syslog excerpt of the "enable-feature --dns" command:

Sep 21 23:00:06 aurora named[995]: received SIGHUP signal to reload zones
Sep 21 23:00:06 aurora named[995]: loading configuration from '/etc/bind/named.conf'
Sep 21 23:00:06 aurora named[995]: reading built-in trusted keys from file '/etc/bind/bind.keys'
Sep 21 23:00:06 aurora named[995]: using default UDP/IPv4 port range: [1024, 65535]
Sep 21 23:00:06 aurora named[995]: using default UDP/IPv6 port range: [1024, 65535]
Sep 21 23:00:06 aurora named[995]: no IPv6 interfaces found
Sep 21 23:00:06 aurora named[995]: sizing zone task pool based on 30 zones
Sep 21 23:00:06 aurora named[995]: using built-in root key for view _default
Sep 21 23:00:06 aurora named[995]: Warning: 'empty-zones-enable/disable-empty-zone' not set: disabling RFC 1918 empty zones
Sep 21 23:00:06 aurora named[995]: reloading configuration succeeded
Sep 21 23:00:06 aurora named[995]: zone testabc.de/IN: has 0 SOA records
Sep 21 23:00:06 aurora named[995]: zone testabc.de/IN: has no NS records
Sep 21 23:00:06 aurora named[995]: zone testabc.de/IN: saved '/var/lib/bind/testabc.de.hosts' as '/var/lib/bind/db-XvNjXaWD'
Sep 21 23:00:06 aurora named[995]: reloading zones succeeded
Sep 21 23:00:06 aurora named[995]: zone testabc.de/IN: Transfer started.
Sep 21 23:00:06 aurora named[995]: transfer of 'testabc.de/IN' from 176.9.188.133#53: connected using 10.10.50.223#58714
Sep 21 23:00:06 aurora named[995]: zone testabc.de/IN: transferred serial 2012092100
Sep 21 23:00:06 aurora named[995]: transfer of 'testabc.de/IN' from 176.9.188.133#53: Transfer completed: 1 messages, 8 recor
ds, 226 bytes, 0.002 secs (113000 bytes/sec)
Sep 21 23:00:06 aurora named[995]: zone testabc.de/IN: sending notifies (serial 2012092100)

The name is exactly the one mentioned in the syslog, "db-XvNjXaWD".

It's possible that BIND creates it... The log sounds like it renames the previously empty zone file to that temporary file. It never did that before -- maybe on Ubuntu 12 it stumbles over the empty zone file that Webmin allegedly creates?

No need to hurry about this though, since it's not critical but merely cosmetic.

The files accumulate. A new one is created each time I turn the DNS feature off and on.

I agree that VM did not.create that file with the odd name. As I said, according to syslog, BIND renamed an empty zone file that appeared right after the zone was created. Don't ask me why it did that.

I am also assuming that the empty zone file WAS created by VMin, because the option which owner to use in the BIND module configuration was effective for that file.

To sum up what I witnessed during my tests:

The Ubuntu 12.04 is DNS cluster slave, another (Ubuntu 10.04) Virtualmin is the master. I create a new domain on the master.

During domain creation, a 0-bytes zone file is created on the slave. At first, the owner of that file was "root:bind" with mode 644, so subsequent BIND accesses failed.

I made the configuration change suggested by Jamie, which fixed the ownership issue. During domain creation, the empty zone file gets created as "bind:bind", and BIND tries to rename it to a random name. AppArmor denied that.

I uninstalled AppArmor. Renaming now works. So, during domain creation, apparently Webmin creates an empty zone file (I suppose it was Webmin, otherwise I wouldn't know why the "ownership" setting would take effect). During the subsequent zone transfer, the empty zone file is renamed (presumably by BIND) to a random file name, and the zone is transferred under the original name.

Assuming Webmin's behavior has not changed in this regard, and it always created an empty zone file as a result of DNS cluster slave zone creation, some change must have been made to BIND which causes it to rename empty zone files before transfer, instead of, like before, simply overwriting them.

Could this syslog entry provide a clue as to why?

Sep 21 23:00:06 aurora named[995]: Warning: 'empty-zones-enable/disable-empty-zone' not set: disabling RFC 1918 empty zones

Another notice:

In the cause of some nameserver reorganization, I'm creating zones in a Webmin manually. Doing so, the mentioned empty zone file does get created, as soon as I click "Create" in the "Create slave zone" dialog. When I then click "Apply zone", the transfer is done, and the existing empty zone is renamed to a random filename.

I agree that it should get deleted. There's no real error message about it in the syslog either. The file just stays behind for no apparent reason.

The zone files reside in /var/lib/bind which is owned by root:bind and has permissions 775, so bind should be able to delete them. The files themselves are owned by bind:bind and perms 644.

Also note that, as mentioned before, AppArmor was preventing BIND from renaming the file and stuff, which is something that never happened on Ubuntu 10.

At least we know now that the issue is not directly related to DNS Cluster Slave, but happens in general when Webmin creates a zone. Maybe you can try to reproduce the behavior, to see if there's just something wonky on my system. I don't think there is, but you never know :)