0005311: Bind does not provide /etc/rndc.key

Notes
(0013942) range (administrator) 2011-12-18 15:41	Cannot reproduce: rpm -qpl bind-9.7.3-2.el6_1.P3.3.x86_64.rpm \|grep rndc /etc/rndc.conf /etc/rndc.key /usr/sbin/rndc /usr/sbin/rndc-confgen And the i386 packages also contain those files.

(0013944) ventura10 (reporter) 2011-12-18 16:12	Although "rpm -qlp" reports the existence of this file, it does not exist. [root@michelangelo ~]# rpm2cpio bind-9.7.3-2.el6_1.P3.3.x86_64.rpm \| cpio -t \| grep rndc ./usr/sbin/rndc ./usr/sbin/rndc-confgen ./usr/share/doc/bind-9.7.3/arm/man.rndc-confgen.html ./usr/share/doc/bind-9.7.3/arm/man.rndc.conf.html ./usr/share/doc/bind-9.7.3/arm/man.rndc.html ./usr/share/man/man5/rndc.conf.5.gz ./usr/share/man/man8/rndc-confgen.8.gz ./usr/share/man/man8/rndc.8.gz Please use rpm2cpio to reproduce the error, or delete your /etc/rndc.key manually and try install this package.

(0013945) range (administrator) 2011-12-18 17:36	Okay, that is "interesting". The i386 version doesn't have it either.

(0013948) range (administrator) 2011-12-18 21:30	Okay. If you look at the changelog you can see that it was a decision by our upstream: * Mon Mar 28 2011 Adam Tkac <atkac redhat com> 32:9.7.3-2 - don't generate rndc.key during installation So the real bug is %ghost %config(noreplace) %{_sysconfdir}/rndc.key # ^- rndc.key now created on first install only if it does not exist # %verify(not size,not md5) %config(noreplace) %attr(0640,root,named) /etc/rndc.conf # ^- Let the named internal default rndc.conf be used - # rndc.conf not required unless it differs from default. %ghost %config(noreplace) %{_sysconfdir}/rndc.conf # ^- The default rndc.conf which uses rndc.key is in named's default internal config - # so rndc.conf is not necessary. as that has not been changed. If you feel this is a bug, you should file an enhancement request at our upstream, but all discussions regarding the removal of config components from bind were a tad fruitless.

(0013950) ventura10 (reporter) 2011-12-18 21:53	Hi range, This file is not been created on the first install. I've tested on a fresh box. The only way to get it working is copying /etc/rndc.key from other server. I really believe this file must exist, at the least, on the first install.

(0013951) range (administrator) 2011-12-18 22:25	Then you have to file a bug report at https://bugzilla.redhat.com/ [^] as we ship what they build feature for feature, bug for bug. I don't know what the reason behind that move was.

(0014122) tmartinson (reporter) 2012-01-08 05:09	This is not a fix, but a work around. I have found no documentation anywhere to help this, but I did read the scripts from the upstream provider on a 5.x system and ran this by hand. It seemed to work. YMMV. I generated the missing file by hand using the rndc-confgen -a and then set the permissions to 666. [root@ns1 ~]# rndc-confgen -a [root@ns1 ~]# chmod 666 /etc/rndc.key Now everything starts without an issue. When I generated the key, it took a bit of time.

(0014177) avij (developer) 2012-01-13 00:11	A better workaround is to chown named /etc/rndc.key instead of chmod 666 /etc/rndc.key If the file mode is 666, even regular users can do whatever can be done with rndc, like stopping the server. Generating the key probably took a while because it collected entropy from the system. Running something like 'du' in a different session will speed that up.

Issue History
Date Modified	Username	Field	Change
2011-12-15 12:39	ventura10	New Issue
2011-12-15 12:42	ventura10	Tag Attached: bind
2011-12-15 12:42	ventura10	Tag Attached: rndc.key
2011-12-18 15:41	range	Note Added: 0013942
2011-12-18 15:42	range	Status	new => feedback
2011-12-18 16:12	ventura10	Note Added: 0013944
2011-12-18 16:12	ventura10	Status	feedback => assigned
2011-12-18 17:36	range	Note Added: 0013945
2011-12-18 21:30	range	Note Added: 0013948
2011-12-18 21:53	ventura10	Note Added: 0013950
2011-12-18 22:25	range	Note Added: 0013951
2012-01-08 05:09	tmartinson	Note Added: 0014122
2012-01-13 00:11	avij	Note Added: 0014177

Relationships