[RISOLTO] Bind9 e modulo Capability

[Vic Steele]

Ciao a tutti.
Seguendo la guida di Navajo e Conraid sul WikiSlack, inerente l'uso di dns in locale con Bind, mi sono imbattuto in un errore riguardo cui non ho trovato risposta (perlomeno, così mi pare), nè ricercando sul forum, nè in Google.
Avviando il demone bind9, mi compare questo errore:

bash-3.1# sh /etc/rc.d/rc.bind start
Starting BIND: /usr/sbin/named
WARNING: named did not start. Perhaps this is because
the "capability" module required by newer kernels is
not loaded (or built into the kernel)?
Attempting to load security capability module:
/sbin/modprobe capability
FATAL: Module capability not found.
Attempting to start named again: /usr/sbin/named
SUCCESS: named started. To avoid this warning in
the future you can edit your /etc/rc.d/rc.modules
to load the "capability" module.

che non mi permette quindi l'utilizzo.
Adesso, se faccio il modprobe mi vien detto che il modulo "capability" non esiste. Dando un occhio al .config del Kernel da me compilato, la voce "Security options/Enable different security modules/Default Linux Capabilities" è modulata, non credo quindi di aver fatto un errore lì.

/etc/rc.d/rc.modules:

### Kernel security models:
# Default Linux Capabilities
# This enables the "default" Linux capabilities functionality, so
# the module will be loaded by default if it looks like we are
# running a new enough kernel:
if echo $SHORTREL | grep -qvw 2.4 ; then
/sbin/modprobe capability
fi

Datemi una mano perchè non capisco cosa c'è che non va.
Grazie a tutti in anticipo.

[conraid]

A me non da nessun errore, e ho l'opzione built-in nel kernel compilato da me.
Tra l'altro in questo pc ho solo huge di kernel standard, ma mi sembra ne anche nell'altro pc, dove uso il generic e basta bind non dia errore.
Oggi controllo meglio

[Vic Steele]

Ti sarei grato se mi facessi sapere la situazione del tuo generic (anche il mio è generic).
Oltretutto mi pare di aver capito leggendo di fretta su una pagina che al momento non trovo , che da una serie di Kernel (a quanto ricordo, da dopo i 2.4) il modulo "capability" è stato ritoccato, e c'è chi usava Bind e dopo un upgrade ha incontrato dei problemi.
Qualcuno ne sa qualcosa?

[conraid]

Ti sarei grato se mi facessi sapere la situazione del tuo generic (anche il mio è generic).
Oltretutto mi pare di aver capito leggendo di fretta su una pagina che al momento non trovo , che da una serie di Kernel (a quanto ricordo, da dopo i 2.4) il modulo "capability" è stato ritoccato, e c'è chi usava Bind e dopo un upgrade ha incontrato dei problemi.
Qualcuno ne sa qualcosa?

C'è scritto anche nel file rc.bind

# Start bind. In the past it was more secure to run BIND
# as a non-root user (for example, with '-u daemon'), but
# the modern version of BIND knows how to use the kernel's
# capability mechanism to drop all root privileges except
# the ability to bind() to a privileged port and set process
# resource limits, so -u should not be needed. If you wish
# to use it anyway, chown the /var/run/named directory to
# the non-root user.

Che versione di BIND stai utilizzando? Il file rc.bind è nuovo o ne mantieni uno vecchio?

[Vic Steele]

La versione di Bind che sto utilizzando è pacchettizzata nei vostri repo il 10 Luglio scorso.
Questo quindi mi ha aggiornato anche rc.bind, no?

[conraid]

La versione di Bind che sto utilizzando è pacchettizzata nei vostri repo il 10 Luglio scorso.
Questo quindi mi ha aggiornato anche rc.bind, no?

Per vostri cosa intendi?
BIND è compreso nella Slackware

[Vic Steele]

Sì scusami, sono stato impreciso. Ho il Bind che avete segnalato voi il 10 Luglio.

[conraid]

Sì scusami, sono stato impreciso. Ho il Bind che avete segnalato voi il 10 Luglio.

Continuo a non capire questo "voi". Mi dici con esattezza quale versione e da dove l'hai scaricata?

[Vic Steele]

Segnalazione di Slacky

Preso ovviamente il pacchetto per 12.1.

[conraid]

Dimenticavo.

Nel generic della current e della 12.1

CONFIG_SECURITY_CAPABILITIES=y

[conraid]

Segnalazione di Slacky

Preso ovviamente il pacchetto per 12.1.

A parte il "voi", quella segnalazione è di Pat non di slacky

Posta l'output dei seguenti comandi

Codice: Seleziona tutto

# grep CAPAB config
# grep CAPAB config-generic-*
# named -v
# named-checkconf
# cat /etc/rc.d/rc.bind

[Vic Steele]

I grep CAPAB mi dicono che il file non c'è, devo eseguirli in qualche directory particolare?

Codice: Seleziona tutto

bash-3.1# named -v
BIND 9.4.2-P1

named-checkconf non mi da nessun output

Codice: Seleziona tutto

bash-3.1# cat /etc/rc.d/rc.bind
#!/bin/sh
# Start/stop/restart the BIND name server daemon (named).

# Start bind.  In the past it was more secure to run BIND
# as a non-root user (for example, with '-u daemon'), but
# the modern version of BIND knows how uses to use the
# kernel's capability mechanism to drop all root privileges
# except the ability to bind() to a privileged port and set
# process resource limits, so -u should not be needed.  If
# you wish to use it anyway, chown the /var/run/named
# directory to the non-root user.
#
# IMPORTANT:  With a 2.6 or newer kernel, if "capability"
# was built as a module you may have to load it first:
#
#modprobe capability
#
# You can uncomment a line in /etc/rc.d/rc.modules to do
# this automatically at boot time.  If your kernel requires
# "capability" to run BIND and you don't load it first, this
# script will attempt to cover for you by loading the
# module anyway, but you'll get some big ugly warnings.  ;-)

# You might also consider running BIND in a "chroot jail",
# a discussion of which may be found in
# /usr/doc/Linux-HOWTOs/Chroot-BIND-HOWTO.
#
# One last note:  rndc has a lot of other nice features that
# it is not within the scope of this start/stop/restart script
# to support.  For more details, see "man rndc" or just type
# "rndc" to see the options.


# Sanity check.  If either /usr/sbin/named or /etc/named.conf
# aren't ready, it doesn't make much sense to try to run this
# script:
if [ ! -x /usr/sbin/named ]; then
  echo "/etc/rc.d/rc.bind:  no /usr/sbin/named found (or not executable); cannot start."
  exit 1
elif [ ! -f /etc/named.conf ]; then
  echo "/etc/rc.d/rc.bind:  no /etc/named.conf found; cannot start /usr/sbin/named."
  exit 1
fi

# Start BIND.  As many times as you like.  ;-)
# Seriously, don't run "rc.bind start" if BIND is already
# running or you'll get more than one copy running.
bind_start() {
  if [ -x /usr/sbin/named ]; then
    echo "Starting BIND:  /usr/sbin/named"
    /usr/sbin/named
  fi
  if ! ps axc | grep -q named ; then
    # A common reason why BIND might not start is that the
    # Linux capabilities module is required on Linux 2.6.
    # So, we will warn the user and then load the module.
    # While it's possible to test to see if this is true,
    # that approach could be a moving target, so we'll
    # just go for the brute force approach.  It's likely
    # to be safe enough.
    echo "WARNING:  named did not start.  Perhaps this is because"
    echo "the \"capability\" module required by newer kernels is"
    echo "not loaded (or built into the kernel)?"
    echo "Attempting to load security capability module:"
    echo "/sbin/modprobe capability"
    /sbin/modprobe capability
    echo "Attempting to start named again:  /usr/sbin/named"
    /usr/sbin/named
    if ps axc | grep -q named ; then
      echo "SUCCESS:  named started.  To avoid this warning in"
      echo "the future you can edit your /etc/rc.d/rc.modules"
      echo "to load the \"capability\" module."
    else
      echo "FAILED:  Sorry, but even after attempting to load"
      echo "the \"capability\" module, named did not start."
      echo "There may be a different configuration error that"
      echo "needs fixing.  Good luck!"
    fi
  fi
}

# Stop all running copies of BIND (/usr/sbin/named):
bind_stop() {
  echo "Stopping BIND:  /usr/sbin/rndc stop"
  /usr/sbin/rndc stop
  # A problem with using "/usr/sbin/rndc stop" is that if you
  # managed to get multiple copies of named running it will
  # only stop one of them and then can't stop the others even
  # if you run it again.  So, after doing things the nice way
  # we'll do them the old-fashioned way.  If you don't like
  # it you can comment it out, but unless you have a lot of
  # other programs you run called "named" this is unlikely
  # to have any ill effects:
  sleep 1
  if ps axc | grep -q named ; then
    echo "Using "killall named" on additional BIND processes..."
    /bin/killall named 2> /dev/null
  fi
}

# Reload BIND:
bind_reload() {
  /usr/sbin/rndc reload
}

# Restart BIND:
bind_restart() {
  bind_stop
  bind_start
}

# Get BIND status:
bind_status() {
  /usr/sbin/rndc status
}

case "$1" in
'start')
  bind_start
  ;;
'stop')
  bind_stop
  ;;
'reload')
  bind_reload
  ;;
'restart')
  bind_restart
  ;;
'status')
  bind_status
  ;;
*)
  echo "usage $0 start|stop|reload|restart|status"
esac

[conraid]

I grep CAPAB mi dicono che il file non c'è, devo eseguirli in qualche directory particolare?

no, devi essere nella directory /boot

e già che ci sei

Codice: Seleziona tutto

# ls -l /etc/rc.d

quando posti un output racchiudilo nei tag code, e non quote



il file rc.bind dovrebbe essere così

Codice: Seleziona tutto

#!/bin/sh
# Start/stop/restart the BIND name server daemon (named).

# Start bind.  In the past it was more secure to run BIND
# as a non-root user (for example, with '-u daemon'), but
# the modern version of BIND knows how to use the kernel's
# capability mechanism to drop all root privileges except
# the ability to bind() to a privileged port and set process
# resource limits, so -u should not be needed.  If you wish
# to use it anyway, chown the /var/run/named directory to
# the non-root user.
#

# You might also consider running BIND in a "chroot jail",
# a discussion of which may be found in
# /usr/doc/Linux-HOWTOs/Chroot-BIND-HOWTO.

# One last note:  rndc has a lot of other nice features that
# it is not within the scope of this start/stop/restart script
# to support.  For more details, see "man rndc" or just type
# "rndc" to see the options.


# Sanity check.  If either /usr/sbin/named or /etc/named.conf
# aren't ready, it doesn't make much sense to try to run this
# script:
if [ ! -x /usr/sbin/named ]; then
  echo "/etc/rc.d/rc.bind:  no /usr/sbin/named found (or not executable); cannot start."
  exit 1
elif [ ! -f /etc/named.conf ]; then
  echo "/etc/rc.d/rc.bind:  no /etc/named.conf found; cannot start /usr/sbin/named."
  exit 1
fi

# Start BIND.  As many times as you like.  ;-)
# Seriously, don't run "rc.bind start" if BIND is already
# running or you'll get more than one copy running.
bind_start() {
  if [ -x /usr/sbin/named ]; then
    echo "Starting BIND:  /usr/sbin/named"
    /usr/sbin/named
    sleep 1
  fi
  if ! ps axc | grep -q named ; then
    echo "WARNING:  named did not start."
    echo "Attempting to start named again:  /usr/sbin/named"
    /usr/sbin/named
    sleep 1
    if ps axc | grep -q named ; then
      echo "SUCCESS:  named started."
    else
      echo "FAILED:  Sorry, a second attempt to start named has also failed."
      echo "There may be a configuration error that needs fixing.  Good luck!"
    fi
  fi
}

# Stop all running copies of BIND (/usr/sbin/named):
bind_stop() {
  echo "Stopping BIND:  /usr/sbin/rndc stop"
  /usr/sbin/rndc stop
  # A problem with using "/usr/sbin/rndc stop" is that if you
  # managed to get multiple copies of named running it will
  # only stop one of them and then can't stop the others even
  # if you run it again.  So, after doing things the nice way
  # we'll do them the old-fashioned way.  If you don't like
  # it you can comment it out, but unless you have a lot of
  # other programs you run called "named" this is unlikely
  # to have any ill effects:
  sleep 1
  if ps axc | grep -q named ; then
    echo "Using "killall named" on additional BIND processes..."
    /bin/killall named 2> /dev/null
  fi
}

# Reload BIND:
bind_reload() {
  /usr/sbin/rndc reload
}

# Restart BIND:
bind_restart() {
  bind_stop
  bind_start
}

# Get BIND status:
bind_status() {
  /usr/sbin/rndc status
}

case "$1" in
'start')
  bind_start
  ;;
'stop')
  bind_stop
  ;;
'reload')
  bind_reload
  ;;
'restart')
  bind_restart
  ;;
'status')
  bind_status
  ;;
*)
  echo "usage $0 start|stop|reload|restart|status"
esac

[Vic Steele]

Editato.

Ok, è giusto, ci sono.

Codice: Seleziona tutto

bash-3.1# grep CAPAB config-2.6.26.5
CONFIG_SECURITY_CAPABILITIES=y
# CONFIG_SECURITY_FILE_CAPABILITIES is not set

Codice: Seleziona tutto

bash-3.1# ls -l /etc/rc.d
total 528
drwxr-xr-x 2 root root  4096 2007-05-15 04:46 init.d
lrwxrwxrwx 1 root root     4 2008-05-15 09:47 rc.0 -> rc.6
-rwxr-xr-x 1 root root  1282 2007-03-27 03:12 rc.4
-rwxr-xr-x 1 root root  7358 2007-06-13 06:27 rc.6
-rwxr-xr-x 1 root root  2322 2007-05-02 23:29 rc.K
-rwxr-xr-x 1 root root  9388 2007-06-12 03:32 rc.M
-rwxr-xr-x 1 root root 10707 2008-04-01 04:00 rc.M.new
-rwxr-xr-x 1 root root 13645 2007-06-28 03:50 rc.S
-rwxr-xr-x 1 root root 13949 2008-03-08 09:01 rc.S.new
-rwxr-xr-x 1 root root   466 2004-11-05 09:20 rc.acpid
-rwxr-xr-x 1 root root  2671 2008-04-01 07:18 rc.alsa
-rw-r--r-- 1 root root  1032 2003-02-02 04:47 rc.atalk
-rwxr-xr-x 1 root root  1577 2008-07-13 17:03 rc.avahidaemon
-rwxr-xr-x 1 root root  1635 2008-07-13 17:03 rc.avahidnsconfd
-rwxr-xr-x 1 root root  4370 2007-06-08 07:02 rc.bind
-rw-r--r-- 1 root root  3116 2008-09-16 10:49 rc.bind.new
-rw-r--r-- 1 root root  3438 2007-05-19 08:04 rc.bluetooth
-rw-r--r-- 1 root root   831 2007-05-19 08:04 rc.bluetooth.conf
-rw-r--r-- 1 root root   106 2008-02-22 22:50 rc.bluetooth.conf.new
-rwxr-xr-x 1 root root  4548 2007-05-09 23:28 rc.cups
-rwxr-xr-x 1 root root  4318 2008-04-29 04:38 rc.cups.new
-rw-r--r-- 1 root root   512 2007-04-30 00:29 rc.dnsmasq
-rw-r--r-- 1 root root   618 2007-11-25 14:51 rc.festival
-rwxr-xr-x 1 root root   119 2004-05-30 06:19 rc.font.new
-rwxr-xr-x 1 root root  1893 2008-04-28 16:07 rc.fuse
-rwxr-xr-x 1 root root  1156 2008-04-26 15:35 rc.gpm
-rwxr-xr-x 1 root root   906 2007-06-28 02:48 rc.hald
-rwxr-xr-x 1 root root  4777 2007-06-10 07:14 rc.hplip
-rw-r--r-- 1 root root   703 2007-07-02 01:12 rc.httpd
-rwxr-xr-x 1 root root  9237 2007-07-01 04:04 rc.inet1
-rw-r--r-- 1 root root  3543 2008-04-26 15:35 rc.inet1.conf
-rw-r--r-- 1 root root  4372 2007-05-10 03:47 rc.inet1.conf.new
-rwxr-xr-x 1 root root  4477 2006-09-21 04:44 rc.inet2
-rwxr-xr-x 1 root root  4847 2007-09-18 00:07 rc.inet2.new
-rwxr-xr-x 1 root root   497 2003-09-12 05:27 rc.inetd
-rwxr-xr-x 1 root root  1924 2003-09-14 01:10 rc.ip_forward
-rwxr-xr-x 1 root root   140 2008-04-26 15:20 rc.keymap
-rwxr-xr-x 1 root root  1191 2008-09-14 15:00 rc.local
-rwxr-xr-x 1 root root   272 2006-08-12 04:07 rc.local.new
-rw-r--r-- 1 root root   446 2008-07-30 19:52 rc.local_shutdown
-rwxr-xr-x 1 root root   272 2008-04-27 16:22 rc.local~
-rwxr-xr-x 1 root root  1560 2007-05-31 04:42 rc.messagebus
lrwxrwxrwx 1 root root    23 2008-04-26 15:03 rc.modules -> rc.modules-2.6.21.5-smp
-rwxr-xr-x 1 root root 28472 2007-06-19 22:20 rc.modules-2.6.21.5
-rwxr-xr-x 1 root root 28472 2007-06-19 21:56 rc.modules-2.6.21.5-smp
-rwxr-xr-x 1 root root 31891 2008-04-30 21:10 rc.modules-2.6.24.5
-rwxr-xr-x 1 root root 31891 2008-04-30 20:39 rc.modules-2.6.24.5-smp
-rw-r--r-- 1 root root  2300 2007-03-24 05:52 rc.mysqld
-rw-r--r-- 1 root root  2585 2008-04-28 23:54 rc.mysqld.new
-rwxr-xr-x 1 root root  2503 2008-06-26 08:46 rc.networkmanager
-rwxr-xr-x 1 root root  2444 2007-05-31 23:21 rc.nfsd
-rwxr-xr-x 1 root root  2457 2008-04-01 05:09 rc.nfsd.new
-rwxr-xr-x 1 root root   561 2007-05-07 07:15 rc.ntpd
-rwxr-xr-x 1 root root  1722 2007-03-16 22:09 rc.pcmcia
-rw-r--r-- 1 root root  1402 2007-05-18 00:53 rc.rpc
-rw-r--r-- 1 root root   791 2007-06-27 05:36 rc.samba
-rw-r--r-- 1 root root  1169 2006-05-27 22:24 rc.saslauthd
-rw-r--r-- 1 root root   967 2006-08-01 05:54 rc.scanluns
-rw-r--r-- 1 root root   687 2002-06-04 23:09 rc.sendmail
-rw-r--r-- 1 root root  2895 2007-06-24 09:33 rc.serial
-rw-r--r-- 1 root root   895 2007-06-19 05:51 rc.snmpd
-rwxr-xr-x 1 root root  1477 2007-04-03 19:36 rc.sshd
-rwxr-xr-x 1 root root   981 2007-04-10 01:10 rc.syslog
-rwxr-xr-x 1 root root  1740 1999-09-11 22:48 rc.sysvinit
-rwxr-xr-x 1 root root  4195 2007-06-25 02:35 rc.udev
-rwxr-xr-x 1 root root  3920 2008-05-15 09:47 rc.udev.new
-rwxr-xr-x 1 root root  8151 2008-09-14 18:24 rc.vboxdrv
-rwxr-xr-x 1 root root 10668 2008-09-14 18:24 rc.vboxnet
-rwxr-xr-x 1 root root 11974 2007-05-19 07:44 rc.wireless
-rw------- 1 root root  7320 2007-05-19 07:44 rc.wireless.conf
-rwxr-xr-x 1 root root 12283 2008-04-23 22:50 rc.wireless.new
-rwxr-xr-x 1 root root  2323 2005-08-01 01:56 rc.yp
drwxr-xr-x 2 root root  4096 2007-05-15 04:46 rc0.d
drwxr-xr-x 2 root root  4096 2007-05-15 04:46 rc1.d
drwxr-xr-x 2 root root  4096 2007-05-15 04:46 rc2.d
drwxr-xr-x 2 root root  4096 2007-05-15 04:46 rc3.d
drwxr-xr-x 2 root root  4096 2007-05-15 04:46 rc4.d
drwxr-xr-x 2 root root  4096 2007-05-15 04:46 rc5.d
drwxr-xr-x 2 root root  4096 2007-05-15 04:46 rc6.d

Mi accorgo che da questo output vengono citati i moduli dei vecchi kernel e non dei miei, perchè?

[conraid]

Tu che kernel stai utilizzando?
Sembra uno compilato da te, non stavi utilizzando un generic?
inoltre hai aggiornato bind, ma non lo script di avvio, vedi quel rc.bind.new?

Sistema un po' la tua configurazione e tutto funzionerà

Inanzitutto metti il nuovo script di avvio, e poi cerca di capire che kernel hai realmente in esecuzione
uname -a

p.s
controllare i file .new è importante