CODEWITHSUNDEEP
dnsbinddhcp
Richard Payne
Richard Payne

Reputation: 101

DHCPD unable to Add Forward map (SERVFAIL)

I've just setup a home server (Ubuntu Server 14) and have configured DNS and DHCP. It all works fine except DDNS. /var/logs/syslog is reporting the following when a new DHCPREQUEST is made:

Jul 25 23:20:14 ns.lan dhcpd: DHCPREQUEST for 192.168.1.73 from <mac> (<hostname>) via eth0
Jul 25 23:20:14 ns.lan dhcpd: DHCPACK on 192.168.1.73 to <mac> (<hostname>) via eth0
Jul 25 23:20:14 ns.lan dhcpd: Unable to add forward map from <hostname>.lan to 192.168.1.73: SERVFAIL

The zone file is set to root:bind and 664.

-rw-r--r-- 1 root root 2389 Jun 29 20:54 bind.keys
-rw-r--r-- 1 root root  237 Jun 29 20:54 db.0
-rw-r--r-- 1 root root  271 Jun 29 20:54 db.127
-rw-r--r-- 1 root bind  313 Jul 25 21:02 db.192
-rw-r--r-- 1 root root  237 Jun 29 20:54 db.255
-rw-r--r-- 1 root root  353 Jun 29 20:54 db.empty
-rw-rw-r-- 1 root bind  387 Jul 25 17:57 db.lan
-rw-r--r-- 1 bind bind    0 Jul 25 20:04 db.lan.jnl
-rw-r--r-- 1 root root  270 Jun 29 20:54 db.local
-rw-r--r-- 1 root root 3048 Jun 29 20:54 db.root
-rw-r--r-- 1 root bind  463 Jun 29 20:54 named.conf
-rw-r--r-- 1 root bind  490 Jun 29 20:54 named.conf.default-zones
-rw-r--r-- 1 root bind  398 Jul 25 17:14 named.conf.local
-rw-r--r-- 1 root bind  998 Jul 25 02:10 named.conf.options
-rw-r----- 1 bind bind   77 Jul 18 01:39 rndc.key
-rw-r--r-- 1 root root 1317 Jun 29 20:54 zones.rfc1918

And I've added the dhcpd user to the bind group:

$ groups dhcpd
dhcpd : dhcpd bind

I've also configured AppArmor (/etc/apparmor.d/usr.sbin.dhcpd) to allow the access:

# Allow access to bind zone file so that it
# can be updated as new hosts are allocated
/etc/bind/db.lan rw,

The zone file looks like this:

;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     ns.lan. hostmaster.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns
@       IN      A       127.0.0.1
@       IN      AAAA    ::1

ns              IN      A       192.168.1.1
server          IN      A       192.168.1.2
media           IN      A       192.168.1.3
web             IN      A       192.168.1.4
dsldevice       IN      A       192.168.1.254

Any ideas on the "Unable to add forward map" SERVFAIL error or even how I can diagnose the problem?

Upvotes: 0

Views: 9864

Answers (2)

Taz8du29
Taz8du29

Reputation: 163

As @Richard Payne said, it's an issue with apparmor.

Running tail -f /var/log/messages should show messages like this:

kernel: [ss.sss]: audit: type=1400: apparmor="DENIED" operation="mknod" profile="/usr/sbin/named" name="/etc/bind/db.<zone>.jnl" ....

So, to solve this, add the following to /etc/apparmord.d/local/usr.sbin.named:

# Allow dynDNS entries to be written, along with journal ant temporary files
/etc/bind/db.* rw,
/etc/bind/tmp-* rw,

Also, make sure that the file /etc/apparmord.d/usr.sbin.named contains an #include directive for the file with our changes. It is generally at the end, and looks like this:

# Site-specific additions and overrides
#include <local/usr.sbin.named>

Then, restart apparmor and bind

sudo systemctl restart apparmor
sudo systemctl restart bind9

Upvotes: 4

Richard Payne
Richard Payne

Reputation: 101

I ended up re-jigging the file structure a little and something I've done has made it work. I guess that points at a permissions issue, probably apparmor related at a guess.

Upvotes: 1

Related Questions