Problem w/ "knotc conf-read zone[name]" Fix: USE SHELL QUOTING!
Hi,
i'm stumbling over this behaviour of knot cconf-read zone[name]:
root@f-dns2:~# knotc conf-read zone
zone.domain = domain.local.
zone.domain = vtnxns.de.
zone[vtnxns.de.].master = f-dns1.vtnx.net
zone[vtnxns.de.].dnssec-signing = off
root@f-dns2:~# knotc conf-read zone[vtnxns.de.]
error: (invalid item) zones
root@f-dns2:~# knotc conf-read key
key.id = f-dns1.vtnx.net.
key[f-dns1.vtnx.net.].algorithm = hmac-sha512
key[f-dns1.vtnx.net.].secret = ...
key.id = f-dns2.vtnx.net.
key[f-dns2.vtnx.net.].algorithm = hmac-sha512
key[f-dns2.vtnx.net.].secret = ...
key.id = f-dns3.vtnx.net.
key[f-dns3.vtnx.net.].algorithm = hmac-sha512
key[f-dns3.vtnx.net.].secret = ...
root@f-dns2:~# knotc conf-read key[f-dns2.vtnx.net.]
key.id = f-dns2.vtnx.net.
key[f-dns2.vtnx.net.].algorithm = hmac-sha512
key[f-dns2.vtnx.net.].secret = ...
root@f-dns2:~# dpkg-query -W knot
knot 2.7.3-1~ubuntu18.04.1ppa2My initial problem is the failed zonetransfer to the slave:
Oct 26 08:59:41 f-dns2 knotd[5853]: info: [vtnxns.de.] control, received command 'zone-retransfer'
Oct 26 08:59:41 f-dns2 knotd[5853]: warning: [vtnxns.de.] refresh, remote f-dns1.vtnx.net not usable
Oct 26 08:59:41 f-dns2 knotd[5853]: error: [vtnxns.de.] refresh, failed (no usable master)root@f-dns2:~# knotc conf-read remote[f-dns1.vtnx.net]
remote.id = f-dns1.vtnx.net
remote[f-dns1.vtnx.net].address = 192.168.120.211
remote[f-dns1.vtnx.net].key = f-dns1.vtnx.net.
root@f-dns2:~# knotc conf-read key[f-dns1.vtnx.net]
key.id = f-dns1.vtnx.net.
key[f-dns1.vtnx.net.].algorithm = hmac-sha512
key[f-dns1.vtnx.net.].secret = ...Greetings, Frank
Activity
Hi @fmatthiess, I'm unable to reproduce it. This part doesn't make sense to me:
root@f-dns2:~# knotc conf-read zone[vtnxns.de.] error: (invalid item) zonesDoes this happen for each configured zone and every time? Do you use a configuration database?
Btw, the failed zone retransfer is not an issue with Knot, right?
On an fresh installed system:
root@f-dns3:~# cat<<EOKNOTC | knotc conf-abort conf-begin conf-set 'zone.domain' 'vtnxns.de' conf-set 'zone[vtnxns.de].dnssec-signing' 'off' conf-commit zone-abort vtnxns.de zone-begin vtnxns.de zone-set vtnxns.de @ 259200 IN SOA ns1.vtnxns.de. hostmaster.redacted.tld. 1 16384 2048 1048576 259200 zone-set vtnxns.de @ 259200 IN NS ns1.vtnxns.de. zone-set vtnxns.de @ 259200 IN NS ns2.vtnxns.de. zone-set vtnxns.de @ 259200 IN NS ns3.vtnxns.de. zone-set vtnxns.de ns1 86400 IN A 192.168.120.211 zone-set vtnxns.de ns2 86400 IN A 192.168.120.212 zone-set vtnxns.de ns3 86400 IN A 192.168.120.213 zone-commit vtnxns.de EOKNOTC root@f-dns3:~# knotc conf-read zone su - knot ... zone.domain = domain.local. zone.domain = vtnxns.de. zone[vtnxns.de.].dnssec-signing = off root@f-dns3:~# knotc conf-read zone[vtnxns.de.] su - knot ... error: (invalid item) zones root@f-dns3:~# knotc conf-read zone[vtnxns.de] su - knot ... error: (invalid item) zones root@f-dns3:~# knotc conf-read zone[domain.local] su - knot ... zone.domain = domain.local.For domain.local, i use this script:
conf-begin conf-set zone.domain domain.local conf-commit zone-begin domain.local zone-set domain.local @ 7200 SOA f-dns1.vtnx.net. hostmaster 1 86400 900 691200 3600 zone-set domain.local @ 3600 NS f-dns1.vtnx.net. zone-commit domain.localGreetings, Frank
This seems wierd to me:
root@f-dns1:~# knotc conf-read zone su - knot ... zone.domain = domain.local. zone.domain = vtnxns.de. zone[vtnxns.de.].dnssec-signing = off root@f-dns1:~# knotc conf-read zone[vtnxns.de.] su - knot ... error: (invalid item) zones root@f-dns1:~# knotc conf-read zone[vtnxns.de.].dnssec-signing su - knot ... zone[vtnxns.de.].dnssec-signing = offGreetings, Frank
Yes, it's an ubuntu 18.04
root@f-dns1:~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 18.04.1 LTS Release: 18.04 Codename: bionicroot@f-dns1:~# dpkg-query -W | grep systemd libnss-systemd:amd64 237-3ubuntu10.3 libpam-systemd:amd64 237-3ubuntu10.3 libsystemd0:amd64 237-3ubuntu10.3 systemd 237-3ubuntu10.3 systemd-sysv 237-3ubuntu10.3root@f-dns1:~# systemctl UNIT LOAD ACTIVE SUB DESCRIPTION proc-sys-fs-binfmt_misc.automount loaded active running Arbitrary Executable File Formats File System Automount Point sys-devices-pci0000:00-0000:00:01.1-ata1-host0-target0:0:0-0:0:0:0-block-sr0.device loaded active plugged QEMU_DVD-ROM CONTEXT sys-devices-pci0000:00-0000:00:03.0-virtio0-net-ens3.device loaded active plugged Virtio network device sys-devices-pci0000:00-0000:00:05.0-virtio2-block-vda-vda1.device loaded active plugged /sys/devices/pci0000:00/0000:00:05.0/virtio2/block/vda/vda1 sys-devices-pci0000:00-0000:00:05.0-virtio2-block-vda.device loaded active plugged /sys/devices/pci0000:00/0000:00:05.0/virtio2/block/vda sys-devices-pci0000:00-0000:00:06.0-virtio3-block-vdb.device loaded active plugged /sys/devices/pci0000:00/0000:00:06.0/virtio3/block/vdb sys-devices-platform-serial8250-tty-ttyS0.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS0 sys-devices-platform-serial8250-tty-ttyS1.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS1 sys-devices-platform-serial8250-tty-ttyS10.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS10 sys-devices-platform-serial8250-tty-ttyS11.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS11 sys-devices-platform-serial8250-tty-ttyS12.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS12 sys-devices-platform-serial8250-tty-ttyS13.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS13 sys-devices-platform-serial8250-tty-ttyS14.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS14 sys-devices-platform-serial8250-tty-ttyS15.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS15 sys-devices-platform-serial8250-tty-ttyS16.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS16 sys-devices-platform-serial8250-tty-ttyS17.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS17 sys-devices-platform-serial8250-tty-ttyS18.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS18 sys-devices-platform-serial8250-tty-ttyS19.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS19 sys-devices-platform-serial8250-tty-ttyS2.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS2 sys-devices-platform-serial8250-tty-ttyS20.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS20 sys-devices-platform-serial8250-tty-ttyS21.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS21 sys-devices-platform-serial8250-tty-ttyS22.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS22 sys-devices-platform-serial8250-tty-ttyS23.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS23 sys-devices-platform-serial8250-tty-ttyS24.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS24 sys-devices-platform-serial8250-tty-ttyS25.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS25 sys-devices-platform-serial8250-tty-ttyS26.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS26 sys-devices-platform-serial8250-tty-ttyS27.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS27 sys-devices-platform-serial8250-tty-ttyS28.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS28 sys-devices-platform-serial8250-tty-ttyS29.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS29 sys-devices-platform-serial8250-tty-ttyS3.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS3 sys-devices-platform-serial8250-tty-ttyS30.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS30 sys-devices-platform-serial8250-tty-ttyS31.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS31 sys-devices-platform-serial8250-tty-ttyS4.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS4 sys-devices-platform-serial8250-tty-ttyS5.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS5 sys-devices-platform-serial8250-tty-ttyS6.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS6 sys-devices-platform-serial8250-tty-ttyS7.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS7 sys-devices-platform-serial8250-tty-ttyS8.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS8 sys-devices-platform-serial8250-tty-ttyS9.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS9 sys-devices-virtual-misc-rfkill.device loaded active plugged /sys/devices/virtual/misc/rfkill sys-devices-virtual-net-lo.device loaded active plugged /sys/devices/virtual/net/lo sys-devices-virtual-tty-ttyprintk.device loaded active plugged /sys/devices/virtual/tty/ttyprintk sys-module-configfs.device loaded active plugged /sys/module/configfs sys-module-fuse.device loaded active plugged /sys/module/fuse sys-subsystem-net-devices-ens3.device loaded active plugged Virtio network device -.mount loaded active mounted Root Mount dev-hugepages.mount loaded active mounted Huge Pages File System dev-mqueue.mount loaded active mounted POSIX Message Queue File System proc-sys-fs-binfmt_misc.mount loaded active mounted Arbitrary Executable File Formats File System run-user-0.mount loaded active mounted /run/user/0 sys-fs-fuse-connections.mount loaded active mounted FUSE Control File System sys-kernel-config.mount loaded active mounted Kernel Configuration File System sys-kernel-debug.mount loaded active mounted Kernel Debug File System acpid.path loaded active waiting ACPI Events Check systemd-ask-password-console.path loaded active waiting Dispatch Password Requests to Console Directory Watch systemd-ask-password-wall.path loaded active waiting Forward Password Requests to Wall Directory Watch init.scope loaded active running System and Service Manager session-5.scope loaded active running Session 5 of user root session-6.scope loaded active running Session 6 of user root accounts-daemon.service loaded active running Accounts Service apparmor.service loaded active exited AppArmor initialization chrony.service loaded active running chrony, an NTP client/server console-setup.service loaded active exited Set console font and keymap cron.service loaded active running Regular background program processing daemon dbus.service loaded active running D-Bus System Message Bus getty@tty1.service loaded active running Getty on tty1 grub-common.service loaded active exited LSB: Record successful boot for GRUB ifup@ens3.service loaded active exited ifup for ens3 inetd.service loaded active running Internet superserver keyboard-setup.service loaded active exited Set the console keyboard layout kmod-static-nodes.service loaded active exited Create list of required static device nodes for the current kernel knot.service loaded active running Knot DNS server networkd-dispatcher.service loaded active running Dispatcher daemon for systemd-networkd networking.service loaded active exited Raise network interfaces ● one-context-force.service loaded failed failed OpenNebula forced reconfiguration one-context-local.service loaded active exited OpenNebula pre-networking contextualization script one-context.service loaded active exited OpenNebula contextualization script postfix.service loaded active exited Postfix Mail Transport Agent postfix@-.service loaded active running Postfix Mail Transport Agent (instance -) qemu-guest-agent.service loaded active exited LSB: QEMU Guest Agent startup script rsyslog.service loaded active running System Logging Service setvtrgb.service loaded active exited Set console scheme snmpd.service loaded active running Simple Network Management Protocol (SNMP) Daemon. ssh.service loaded active running OpenBSD Secure Shell server sysstat.service loaded active exited Resets System Activity Data Collector systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage systemd-journald.service loaded active running Journal Service systemd-logind.service loaded active running Login Service systemd-modules-load.service loaded active exited Load Kernel Modules systemd-random-seed.service loaded active exited Load/Save Random Seed systemd-remount-fs.service loaded active exited Remount Root and Kernel File Systems systemd-sysctl.service loaded active exited Apply Kernel Variables systemd-timesyncd.service loaded active running Network Time Synchronization systemd-tmpfiles-setup-dev.service loaded active exited Create Static Device Nodes in /dev systemd-tmpfiles-setup.service loaded active exited Create Volatile Files and Directories systemd-udev-settle.service loaded active exited udev Wait for Complete Device Initialization systemd-udev-trigger.service loaded active exited udev Coldplug all Devices systemd-udevd.service loaded active running udev Kernel Device Manager systemd-update-utmp.service loaded active exited Update UTMP about System Boot/Shutdown systemd-user-sessions.service loaded active exited Permit User Sessions ufw.service loaded active exited Uncomplicated firewall user@0.service loaded active running User Manager for UID 0 -.slice loaded active active Root Slice system-getty.slice loaded active active system-getty.slice system-postfix.slice loaded active active system-postfix.slice system.slice loaded active active System Slice user-0.slice loaded active active User Slice of root user.slice loaded active active User and Session Slice acpid.socket loaded active listening ACPID Listen Socket dbus.socket loaded active running D-Bus System Message Bus Socket syslog.socket loaded active running Syslog Socket systemd-fsckd.socket loaded active listening fsck to fsckd communication Socket systemd-initctl.socket loaded active listening /dev/initctl Compatibility Named Pipe systemd-journald-audit.socket loaded active running Journal Audit Socket systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/log) systemd-journald.socket loaded active running Journal Socket systemd-rfkill.socket loaded active listening Load/Save RF Kill Switch Status /dev/rfkill Watch systemd-udevd-control.socket loaded active running udev Control Socket systemd-udevd-kernel.socket loaded active running udev Kernel Socket uuidd.socket loaded active listening UUID daemon activation socket dev-vdb.swap loaded active active /dev/vdb basic.target loaded active active Basic System cryptsetup.target loaded active active Local Encrypted Volumes getty.target loaded active active Login Prompts graphical.target loaded active active Graphical Interface local-fs-pre.target loaded active active Local File Systems (Pre) local-fs.target loaded active active Local File Systems multi-user.target loaded active active Multi-User System network-online.target loaded active active Network is Online network-pre.target loaded active active Network (Pre) network.target loaded active active Network nss-lookup.target loaded active active Host and Network Name Lookups nss-user-lookup.target loaded active active User and Group Name Lookups paths.target loaded active active Paths remote-fs.target loaded active active Remote File Systems slices.target loaded active active Slices sockets.target loaded active active Sockets swap.target loaded active active Swap sysinit.target loaded active active System Initialization time-sync.target loaded active active System Time Synchronized timers.target loaded active active Timers apt-daily-upgrade.timer loaded active waiting Daily apt upgrade and clean activities apt-daily.timer loaded active waiting Daily apt download activities fstrim.timer loaded active waiting Discard unused blocks once a week motd-news.timer loaded active elapsed Message of the Day systemd-tmpfiles-clean.timer loaded active waiting Daily Cleanup of Temporary Directories LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, i.e. generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. 145 loaded units listed. Pass --all to see loaded but inactive units, too. To show all installed unit files use 'systemctl list-unit-files'.So far no success in reproduction :-( I tried Ubuntu live CD, Docker, and my desktop. If you could give me access to a testing server, it would be very helpful! Email daniel.salzman@nic.cz
Edited by Daniel SalzmanOne hint from Danial was, to initialize the knot config as user "knot" and not with
su -c "knotc $*" - knotwrapper as root.I change that in my ansible roles, but the problem persist:
knot@f-dns1:~$ cat<<EOKNOTC | knotc > conf-abort > > conf-begin > conf-set 'zone.domain' 'vtnxns.de' > conf-set 'zone[vtnxns.de].dnssec-signing' 'off' > conf-commit > > zone-abort vtnxns.de > > zone-begin vtnxns.de > zone-set vtnxns.de @ 259200 IN SOA ns1.vtnxns.de. hostmaster.redacted.tld. 1 16384 2048 1048576 259200 > zone-set vtnxns.de @ 259200 IN NS ns1.vtnxns.de. > zone-set vtnxns.de @ 259200 IN NS ns2.vtnxns.de. > zone-set vtnxns.de @ 259200 IN NS ns3.vtnxns.de. > zone-set vtnxns.de ns1 86400 IN A 192.168.120.211 > zone-set vtnxns.de ns2 86400 IN A 192.168.120.212 > zone-set vtnxns.de ns3 86400 IN A 192.168.120.213 > zone-commit vtnxns.de > EOKNOTC OK OK OK OK OK error: [vtnxns.de] (no active transaction) OK OK OK OK OK OK OK OK OK knot@f-dns1:~$ knotc conf-read zone zone.domain = domain.local. zone.domain = vtnxns.de. zone[vtnxns.de.].dnssec-signing = off knot@f-dns1:~$ knotc conf-read zone[vtnxns.de.] error: (invalid item) zones knot@f-dns1:~$ knotc conf-read zone[vtnxns.de].dnssec-signing zone[vtnxns.de.].dnssec-signing = offadded discussion knot labels
Please register or sign in to reply