Pagina 1 di 2
[RISOLTO] Bind9 e modulo Capability
Inviato: mar 16 set 2008, 12:37
da Vic Steele
Ciao a tutti.
Seguendo la guida di Navajo e Conraid sul WikiSlack, inerente l'uso di dns in locale con Bind, mi sono imbattuto in un errore riguardo cui non ho trovato risposta (perlomeno, così mi pare), nè ricercando sul forum, nè in Google.
Avviando il demone bind9, mi compare questo errore:
bash-3.1# sh /etc/rc.d/rc.bind start
Starting BIND: /usr/sbin/named
WARNING: named did not start. Perhaps this is because
the "capability" module required by newer kernels is
not loaded (or built into the kernel)?
Attempting to load security capability module:
/sbin/modprobe capability
FATAL: Module capability not found.
Attempting to start named again: /usr/sbin/named
SUCCESS: named started. To avoid this warning in
the future you can edit your /etc/rc.d/rc.modules
to load the "capability" module.
che non mi permette quindi l'utilizzo.
Adesso, se faccio il modprobe mi vien detto che il modulo "capability" non esiste. Dando un occhio al .config del Kernel da me compilato, la voce "Security options/Enable different security modules/Default Linux Capabilities" è modulata, non credo quindi di aver fatto un errore lì.
/etc/rc.d/rc.modules:
### Kernel security models:
# Default Linux Capabilities
# This enables the "default" Linux capabilities functionality, so
# the module will be loaded by default if it looks like we are
# running a new enough kernel:
if echo $SHORTREL | grep -qvw 2.4 ; then
/sbin/modprobe capability
fi
Datemi una mano perchè non capisco cosa c'è che non va.
Grazie a tutti in anticipo.
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 12:56
da conraid
A me non da nessun errore, e ho l'opzione built-in nel kernel compilato da me.
Tra l'altro in questo pc ho solo huge di kernel standard, ma mi sembra ne anche nell'altro pc, dove uso il generic e basta bind non dia errore.
Oggi controllo meglio
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 13:20
da Vic Steele
Ti sarei grato se mi facessi sapere la situazione del tuo generic (anche il mio è generic).
Oltretutto mi pare di aver capito leggendo di fretta su una pagina che al momento non trovo
, che da una serie di Kernel (a quanto ricordo, da dopo i 2.4) il modulo "capability" è stato ritoccato, e c'è chi usava Bind e dopo un upgrade ha incontrato dei problemi.
Qualcuno ne sa qualcosa?
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 13:48
da conraid
Vic Steele ha scritto:Ti sarei grato se mi facessi sapere la situazione del tuo generic (anche il mio è generic).
Oltretutto mi pare di aver capito leggendo di fretta su una pagina che al momento non trovo
, che da una serie di Kernel (a quanto ricordo, da dopo i 2.4) il modulo "capability" è stato ritoccato, e c'è chi usava Bind e dopo un upgrade ha incontrato dei problemi.
Qualcuno ne sa qualcosa?
C'è scritto anche nel file rc.bind
# Start bind. In the past it was more secure to run BIND
# as a non-root user (for example, with '-u daemon'), but
# the modern version of BIND knows how to use the kernel's
# capability mechanism to drop all root privileges except
# the ability to bind() to a privileged port and set process
# resource limits, so -u should not be needed. If you wish
# to use it anyway, chown the /var/run/named directory to
# the non-root user.
Che versione di BIND stai utilizzando? Il file rc.bind è nuovo o ne mantieni uno vecchio?
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:26
da Vic Steele
La versione di Bind che sto utilizzando è pacchettizzata nei vostri repo il 10 Luglio scorso.
Questo quindi mi ha aggiornato anche rc.bind, no?
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:34
da conraid
Vic Steele ha scritto:La versione di Bind che sto utilizzando è pacchettizzata nei vostri repo il 10 Luglio scorso.
Questo quindi mi ha aggiornato anche rc.bind, no?
Per vostri cosa intendi?
BIND è compreso nella Slackware
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:36
da Vic Steele
Sì scusami, sono stato impreciso. Ho il Bind che avete segnalato voi il 10 Luglio.
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:39
da conraid
Vic Steele ha scritto:Sì scusami, sono stato impreciso. Ho il Bind che avete segnalato voi il 10 Luglio.
Continuo a non capire questo "voi". Mi dici con esattezza quale versione e da dove l'hai scaricata?
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:42
da Vic Steele
Segnalazione di Slacky
Preso ovviamente il pacchetto per 12.1.
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:42
da conraid
Dimenticavo.
Nel generic della current e della 12.1
CONFIG_SECURITY_CAPABILITIES=y
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:45
da conraid
A parte il "voi", quella segnalazione è di Pat non di slacky
Posta l'output dei seguenti comandi
Codice: Seleziona tutto
# grep CAPAB config
# grep CAPAB config-generic-*
# named -v
# named-checkconf
# cat /etc/rc.d/rc.bind
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:52
da Vic Steele
I grep CAPAB mi dicono che il file non c'è, devo eseguirli in qualche directory particolare?
named-checkconf non mi da nessun output
Codice: Seleziona tutto
bash-3.1# cat /etc/rc.d/rc.bind
#!/bin/sh
# Start/stop/restart the BIND name server daemon (named).
# Start bind. In the past it was more secure to run BIND
# as a non-root user (for example, with '-u daemon'), but
# the modern version of BIND knows how uses to use the
# kernel's capability mechanism to drop all root privileges
# except the ability to bind() to a privileged port and set
# process resource limits, so -u should not be needed. If
# you wish to use it anyway, chown the /var/run/named
# directory to the non-root user.
#
# IMPORTANT: With a 2.6 or newer kernel, if "capability"
# was built as a module you may have to load it first:
#
#modprobe capability
#
# You can uncomment a line in /etc/rc.d/rc.modules to do
# this automatically at boot time. If your kernel requires
# "capability" to run BIND and you don't load it first, this
# script will attempt to cover for you by loading the
# module anyway, but you'll get some big ugly warnings. ;-)
# You might also consider running BIND in a "chroot jail",
# a discussion of which may be found in
# /usr/doc/Linux-HOWTOs/Chroot-BIND-HOWTO.
#
# One last note: rndc has a lot of other nice features that
# it is not within the scope of this start/stop/restart script
# to support. For more details, see "man rndc" or just type
# "rndc" to see the options.
# Sanity check. If either /usr/sbin/named or /etc/named.conf
# aren't ready, it doesn't make much sense to try to run this
# script:
if [ ! -x /usr/sbin/named ]; then
echo "/etc/rc.d/rc.bind: no /usr/sbin/named found (or not executable); cannot start."
exit 1
elif [ ! -f /etc/named.conf ]; then
echo "/etc/rc.d/rc.bind: no /etc/named.conf found; cannot start /usr/sbin/named."
exit 1
fi
# Start BIND. As many times as you like. ;-)
# Seriously, don't run "rc.bind start" if BIND is already
# running or you'll get more than one copy running.
bind_start() {
if [ -x /usr/sbin/named ]; then
echo "Starting BIND: /usr/sbin/named"
/usr/sbin/named
fi
if ! ps axc | grep -q named ; then
# A common reason why BIND might not start is that the
# Linux capabilities module is required on Linux 2.6.
# So, we will warn the user and then load the module.
# While it's possible to test to see if this is true,
# that approach could be a moving target, so we'll
# just go for the brute force approach. It's likely
# to be safe enough.
echo "WARNING: named did not start. Perhaps this is because"
echo "the \"capability\" module required by newer kernels is"
echo "not loaded (or built into the kernel)?"
echo "Attempting to load security capability module:"
echo "/sbin/modprobe capability"
/sbin/modprobe capability
echo "Attempting to start named again: /usr/sbin/named"
/usr/sbin/named
if ps axc | grep -q named ; then
echo "SUCCESS: named started. To avoid this warning in"
echo "the future you can edit your /etc/rc.d/rc.modules"
echo "to load the \"capability\" module."
else
echo "FAILED: Sorry, but even after attempting to load"
echo "the \"capability\" module, named did not start."
echo "There may be a different configuration error that"
echo "needs fixing. Good luck!"
fi
fi
}
# Stop all running copies of BIND (/usr/sbin/named):
bind_stop() {
echo "Stopping BIND: /usr/sbin/rndc stop"
/usr/sbin/rndc stop
# A problem with using "/usr/sbin/rndc stop" is that if you
# managed to get multiple copies of named running it will
# only stop one of them and then can't stop the others even
# if you run it again. So, after doing things the nice way
# we'll do them the old-fashioned way. If you don't like
# it you can comment it out, but unless you have a lot of
# other programs you run called "named" this is unlikely
# to have any ill effects:
sleep 1
if ps axc | grep -q named ; then
echo "Using "killall named" on additional BIND processes..."
/bin/killall named 2> /dev/null
fi
}
# Reload BIND:
bind_reload() {
/usr/sbin/rndc reload
}
# Restart BIND:
bind_restart() {
bind_stop
bind_start
}
# Get BIND status:
bind_status() {
/usr/sbin/rndc status
}
case "$1" in
'start')
bind_start
;;
'stop')
bind_stop
;;
'reload')
bind_reload
;;
'restart')
bind_restart
;;
'status')
bind_status
;;
*)
echo "usage $0 start|stop|reload|restart|status"
esac
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 14:57
da conraid
Vic Steele ha scritto:I grep CAPAB mi dicono che il file non c'è, devo eseguirli in qualche directory particolare?
no, devi essere nella directory /boot
e già che ci sei
quando posti un output racchiudilo nei tag code, e non quote
il file rc.bind dovrebbe essere così
Codice: Seleziona tutto
#!/bin/sh
# Start/stop/restart the BIND name server daemon (named).
# Start bind. In the past it was more secure to run BIND
# as a non-root user (for example, with '-u daemon'), but
# the modern version of BIND knows how to use the kernel's
# capability mechanism to drop all root privileges except
# the ability to bind() to a privileged port and set process
# resource limits, so -u should not be needed. If you wish
# to use it anyway, chown the /var/run/named directory to
# the non-root user.
#
# You might also consider running BIND in a "chroot jail",
# a discussion of which may be found in
# /usr/doc/Linux-HOWTOs/Chroot-BIND-HOWTO.
# One last note: rndc has a lot of other nice features that
# it is not within the scope of this start/stop/restart script
# to support. For more details, see "man rndc" or just type
# "rndc" to see the options.
# Sanity check. If either /usr/sbin/named or /etc/named.conf
# aren't ready, it doesn't make much sense to try to run this
# script:
if [ ! -x /usr/sbin/named ]; then
echo "/etc/rc.d/rc.bind: no /usr/sbin/named found (or not executable); cannot start."
exit 1
elif [ ! -f /etc/named.conf ]; then
echo "/etc/rc.d/rc.bind: no /etc/named.conf found; cannot start /usr/sbin/named."
exit 1
fi
# Start BIND. As many times as you like. ;-)
# Seriously, don't run "rc.bind start" if BIND is already
# running or you'll get more than one copy running.
bind_start() {
if [ -x /usr/sbin/named ]; then
echo "Starting BIND: /usr/sbin/named"
/usr/sbin/named
sleep 1
fi
if ! ps axc | grep -q named ; then
echo "WARNING: named did not start."
echo "Attempting to start named again: /usr/sbin/named"
/usr/sbin/named
sleep 1
if ps axc | grep -q named ; then
echo "SUCCESS: named started."
else
echo "FAILED: Sorry, a second attempt to start named has also failed."
echo "There may be a configuration error that needs fixing. Good luck!"
fi
fi
}
# Stop all running copies of BIND (/usr/sbin/named):
bind_stop() {
echo "Stopping BIND: /usr/sbin/rndc stop"
/usr/sbin/rndc stop
# A problem with using "/usr/sbin/rndc stop" is that if you
# managed to get multiple copies of named running it will
# only stop one of them and then can't stop the others even
# if you run it again. So, after doing things the nice way
# we'll do them the old-fashioned way. If you don't like
# it you can comment it out, but unless you have a lot of
# other programs you run called "named" this is unlikely
# to have any ill effects:
sleep 1
if ps axc | grep -q named ; then
echo "Using "killall named" on additional BIND processes..."
/bin/killall named 2> /dev/null
fi
}
# Reload BIND:
bind_reload() {
/usr/sbin/rndc reload
}
# Restart BIND:
bind_restart() {
bind_stop
bind_start
}
# Get BIND status:
bind_status() {
/usr/sbin/rndc status
}
case "$1" in
'start')
bind_start
;;
'stop')
bind_stop
;;
'reload')
bind_reload
;;
'restart')
bind_restart
;;
'status')
bind_status
;;
*)
echo "usage $0 start|stop|reload|restart|status"
esac
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 15:13
da Vic Steele
Editato.
Ok, è giusto, ci sono.
Codice: Seleziona tutto
bash-3.1# grep CAPAB config-2.6.26.5
CONFIG_SECURITY_CAPABILITIES=y
# CONFIG_SECURITY_FILE_CAPABILITIES is not set
Codice: Seleziona tutto
bash-3.1# ls -l /etc/rc.d
total 528
drwxr-xr-x 2 root root 4096 2007-05-15 04:46 init.d
lrwxrwxrwx 1 root root 4 2008-05-15 09:47 rc.0 -> rc.6
-rwxr-xr-x 1 root root 1282 2007-03-27 03:12 rc.4
-rwxr-xr-x 1 root root 7358 2007-06-13 06:27 rc.6
-rwxr-xr-x 1 root root 2322 2007-05-02 23:29 rc.K
-rwxr-xr-x 1 root root 9388 2007-06-12 03:32 rc.M
-rwxr-xr-x 1 root root 10707 2008-04-01 04:00 rc.M.new
-rwxr-xr-x 1 root root 13645 2007-06-28 03:50 rc.S
-rwxr-xr-x 1 root root 13949 2008-03-08 09:01 rc.S.new
-rwxr-xr-x 1 root root 466 2004-11-05 09:20 rc.acpid
-rwxr-xr-x 1 root root 2671 2008-04-01 07:18 rc.alsa
-rw-r--r-- 1 root root 1032 2003-02-02 04:47 rc.atalk
-rwxr-xr-x 1 root root 1577 2008-07-13 17:03 rc.avahidaemon
-rwxr-xr-x 1 root root 1635 2008-07-13 17:03 rc.avahidnsconfd
-rwxr-xr-x 1 root root 4370 2007-06-08 07:02 rc.bind
-rw-r--r-- 1 root root 3116 2008-09-16 10:49 rc.bind.new
-rw-r--r-- 1 root root 3438 2007-05-19 08:04 rc.bluetooth
-rw-r--r-- 1 root root 831 2007-05-19 08:04 rc.bluetooth.conf
-rw-r--r-- 1 root root 106 2008-02-22 22:50 rc.bluetooth.conf.new
-rwxr-xr-x 1 root root 4548 2007-05-09 23:28 rc.cups
-rwxr-xr-x 1 root root 4318 2008-04-29 04:38 rc.cups.new
-rw-r--r-- 1 root root 512 2007-04-30 00:29 rc.dnsmasq
-rw-r--r-- 1 root root 618 2007-11-25 14:51 rc.festival
-rwxr-xr-x 1 root root 119 2004-05-30 06:19 rc.font.new
-rwxr-xr-x 1 root root 1893 2008-04-28 16:07 rc.fuse
-rwxr-xr-x 1 root root 1156 2008-04-26 15:35 rc.gpm
-rwxr-xr-x 1 root root 906 2007-06-28 02:48 rc.hald
-rwxr-xr-x 1 root root 4777 2007-06-10 07:14 rc.hplip
-rw-r--r-- 1 root root 703 2007-07-02 01:12 rc.httpd
-rwxr-xr-x 1 root root 9237 2007-07-01 04:04 rc.inet1
-rw-r--r-- 1 root root 3543 2008-04-26 15:35 rc.inet1.conf
-rw-r--r-- 1 root root 4372 2007-05-10 03:47 rc.inet1.conf.new
-rwxr-xr-x 1 root root 4477 2006-09-21 04:44 rc.inet2
-rwxr-xr-x 1 root root 4847 2007-09-18 00:07 rc.inet2.new
-rwxr-xr-x 1 root root 497 2003-09-12 05:27 rc.inetd
-rwxr-xr-x 1 root root 1924 2003-09-14 01:10 rc.ip_forward
-rwxr-xr-x 1 root root 140 2008-04-26 15:20 rc.keymap
-rwxr-xr-x 1 root root 1191 2008-09-14 15:00 rc.local
-rwxr-xr-x 1 root root 272 2006-08-12 04:07 rc.local.new
-rw-r--r-- 1 root root 446 2008-07-30 19:52 rc.local_shutdown
-rwxr-xr-x 1 root root 272 2008-04-27 16:22 rc.local~
-rwxr-xr-x 1 root root 1560 2007-05-31 04:42 rc.messagebus
lrwxrwxrwx 1 root root 23 2008-04-26 15:03 rc.modules -> rc.modules-2.6.21.5-smp
-rwxr-xr-x 1 root root 28472 2007-06-19 22:20 rc.modules-2.6.21.5
-rwxr-xr-x 1 root root 28472 2007-06-19 21:56 rc.modules-2.6.21.5-smp
-rwxr-xr-x 1 root root 31891 2008-04-30 21:10 rc.modules-2.6.24.5
-rwxr-xr-x 1 root root 31891 2008-04-30 20:39 rc.modules-2.6.24.5-smp
-rw-r--r-- 1 root root 2300 2007-03-24 05:52 rc.mysqld
-rw-r--r-- 1 root root 2585 2008-04-28 23:54 rc.mysqld.new
-rwxr-xr-x 1 root root 2503 2008-06-26 08:46 rc.networkmanager
-rwxr-xr-x 1 root root 2444 2007-05-31 23:21 rc.nfsd
-rwxr-xr-x 1 root root 2457 2008-04-01 05:09 rc.nfsd.new
-rwxr-xr-x 1 root root 561 2007-05-07 07:15 rc.ntpd
-rwxr-xr-x 1 root root 1722 2007-03-16 22:09 rc.pcmcia
-rw-r--r-- 1 root root 1402 2007-05-18 00:53 rc.rpc
-rw-r--r-- 1 root root 791 2007-06-27 05:36 rc.samba
-rw-r--r-- 1 root root 1169 2006-05-27 22:24 rc.saslauthd
-rw-r--r-- 1 root root 967 2006-08-01 05:54 rc.scanluns
-rw-r--r-- 1 root root 687 2002-06-04 23:09 rc.sendmail
-rw-r--r-- 1 root root 2895 2007-06-24 09:33 rc.serial
-rw-r--r-- 1 root root 895 2007-06-19 05:51 rc.snmpd
-rwxr-xr-x 1 root root 1477 2007-04-03 19:36 rc.sshd
-rwxr-xr-x 1 root root 981 2007-04-10 01:10 rc.syslog
-rwxr-xr-x 1 root root 1740 1999-09-11 22:48 rc.sysvinit
-rwxr-xr-x 1 root root 4195 2007-06-25 02:35 rc.udev
-rwxr-xr-x 1 root root 3920 2008-05-15 09:47 rc.udev.new
-rwxr-xr-x 1 root root 8151 2008-09-14 18:24 rc.vboxdrv
-rwxr-xr-x 1 root root 10668 2008-09-14 18:24 rc.vboxnet
-rwxr-xr-x 1 root root 11974 2007-05-19 07:44 rc.wireless
-rw------- 1 root root 7320 2007-05-19 07:44 rc.wireless.conf
-rwxr-xr-x 1 root root 12283 2008-04-23 22:50 rc.wireless.new
-rwxr-xr-x 1 root root 2323 2005-08-01 01:56 rc.yp
drwxr-xr-x 2 root root 4096 2007-05-15 04:46 rc0.d
drwxr-xr-x 2 root root 4096 2007-05-15 04:46 rc1.d
drwxr-xr-x 2 root root 4096 2007-05-15 04:46 rc2.d
drwxr-xr-x 2 root root 4096 2007-05-15 04:46 rc3.d
drwxr-xr-x 2 root root 4096 2007-05-15 04:46 rc4.d
drwxr-xr-x 2 root root 4096 2007-05-15 04:46 rc5.d
drwxr-xr-x 2 root root 4096 2007-05-15 04:46 rc6.d
Mi accorgo che da questo output vengono citati i moduli dei vecchi kernel e non dei miei, perchè?
Re: Bind9 e modulo Capability
Inviato: mar 16 set 2008, 15:19
da conraid
Tu che kernel stai utilizzando?
Sembra uno compilato da te, non stavi utilizzando un generic?
inoltre hai aggiornato bind, ma non lo script di avvio, vedi quel rc.bind.new?
Sistema un po' la tua configurazione e tutto funzionerà
Inanzitutto metti il nuovo script di avvio, e poi cerca di capire che kernel hai realmente in esecuzione
uname -a
p.s
controllare i file .new è importante