Closed HLFH closed 7 years ago
I am using the default pdns.service
file as shipped with arch with one modification: Change back to Type=notify
(which is the pdns default) and remove (see also #4179 and #4161) the chroot=
setting which is located at the bottom of pdns.conf
and originates from packaging. Everything works out just fine for me.
@bjoe2k4 Are you talking exactly about this systemd
file?
[Unit]
Description=PowerDNS Authoritative Server
Documentation=man:pdns_server(1) man:pdns_control(1)
Documentation=https://doc.powerdns.com
Wants=network-online.target
After=network-online.target mysqld.service postgresql.service slapd.service
[Service]
Type=notify
ExecStart=/usr/bin/pdns_server --guardian=no --daemon=no --disable-syslog --write-pid=no
Restart=on-failure
RestartSec=1
StartLimitInterval=0
PrivateTmp=true
PrivateDevices=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_CHOWN CAP_SYS_CHROOT
NoNewPrivileges=true
# ProtectSystem=full will disallow write access to /etc and /usr, possibly
# not being able to write slaved-zones into sqlite3 or zonefiles.
ProtectSystem=full
ProtectHome=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
[Install]
WantedBy=multi-user.target
But by using this systemd
file, I'm getting this issue:
-- L'unité (unit) pdns.service a commencé à démarrer.
sept. 25 14:35:41 nssec.hlfh.space pdns_server[848]: Sep 25 14:35:41 Reading random entropy from '/dev/urandom'
sept. 25 14:35:41 nssec.hlfh.space pdns_server[848]: Sep 25 14:35:41 Loading '/usr/lib/powerdns/libgmysqlbackend.so'
sept. 25 14:35:41 nssec.hlfh.space pdns_server[848]: Sep 25 14:35:41 [gmysqlbackend] This is the gmysql backend version 4.0.1 reporting
sept. 25 14:35:41 nssec.hlfh.space pdns_server[848]: Sep 25 14:35:41 This is a standalone pdns
sept. 25 14:35:41 nssec.hlfh.space pdns_server[848]: Sep 25 14:35:41 Listening on controlsocket in '/var/run/pdns.controlsocket'
sept. 25 14:35:41 nssec.hlfh.space pdns_server[848]: Sep 25 14:35:41 Unable to bind UDP socket to '0.0.0.0:53': Address already in use
sept. 25 14:35:41 nssec.hlfh.space pdns_server[848]: Sep 25 14:35:41 Fatal error: Unable to bind to UDP socket
sept. 25 14:35:41 nssec.hlfh.space systemd[1]: pdns.service: Main process exited, code=exited, status=1/FAILURE
sept. 25 14:35:41 nssec.hlfh.space systemd[1]: Failed to start PowerDNS Authoritative Server.
-- Subject: L'unité (unit) pdns.service a échoué
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- L'unité (unit) pdns.service a échoué, avec le résultat failed.
sept. 25 14:35:41 nssec.hlfh.space systemd[1]: pdns.service: Unit entered failed state.
sept. 25 14:35:41 nssec.hlfh.space systemd[1]: pdns.service: Failed with result 'exit-code'.
So, I'm getting then the issue: "Unable to bind UDP socket to '0.0.0.0:53': Address already in use [...] Fatal error: Unable to bind to UDP socket"
Whats systemctl status systemd-resolved.service
?
Now it's working THANKS if I'm stopping systemd-resolved.service
. And I don't understand why. Couldn't we use pdns
AND systemd-resolved
?
You can, but you have to bind pdns to your external interface. systemd-resolved
is listening on 127.0.0.53:53
. Therefore you cannot listen on 0.0.0.0:53
as this also includes 127.0.0.53:53
.
Seems related to https://github.com/systemd/systemd/pull/4061, @poettering again :)
I'd rather say @usererror ;-) The same would have happened if you'd install any local resolver like pdns-recursor or dnsmasq.
But pdns-recursor
is a recursive DNS resolver, and systemd-resolved
is only a stub DNS resolver. Furthermore, this issue is only happening since systemd 231
released on 2016-07-25:
systemd-resolved now listens on the local IP address 127.0.0.53:53
for DNS requests. This improves compatibility with local programs
that do not use the libc NSS or systemd-resolved's bus APIs for name
resolution. This minimal DNS service is only available to local
programs and does not implement the full DNS protocol, but enough to
cover local DNS clients. A new, static resolv.conf file, listing just
this DNS server is now shipped in /usr/lib/systemd/resolv.conf. It is
now recommended to make /etc/resolv.conf a symlink to this file in
order to route all DNS lookups to systemd-resolved, regardless if
done via NSS, the bus API or raw DNS packets. Note that this local
DNS service is not as fully featured as the libc NSS or
systemd-resolved's bus APIs. For example, as unicast DNS cannot be
used to deliver link-local address information (as this implies
sending a local interface index along), LLMNR/mDNS support via this
interface is severely restricted. It is thus strongly recommended for
all applications to use the libc NSS API or native systemd-resolved
bus API instead.
In fact, this change has created a conflict with authoritative DNS servers like PowerDNS
and we need this issue solved. So YES, it's @poettering. And I'm just saying that systemd
has done an interesting change...that needs to be improved and fixed to avoid any conflict between the stub resolver systemd-resolved
and the authoritative resolver pdns
.
@HLFH want to change the ticket title to cover the actual issue here?
The workaround is thanks to @bjoe2k4:
systemctl stop systemd-resolved
systemctl disable systemd-resolved
vim /etc/systemd/system/pdns.service
[Unit]
Description=PowerDNS Authoritative Server
Documentation=man:pdns_server(1) man:pdns_control(1)
Documentation=https://doc.powerdns.com
Wants=network-online.target
After=network-online.target mysqld.service postgresql.service slapd.service
[Service]
Type=notify
ExecStart=/usr/bin/pdns_server --guardian=no --daemon=no --disable-syslog --write-pid=no
Restart=on-failure
RestartSec=1
StartLimitInterval=0
PrivateTmp=true
PrivateDevices=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_CHOWN CAP_SYS_CHROOT
NoNewPrivileges=true
# ProtectSystem=full will disallow write access to /etc and /usr, possibly
# not being able to write slaved-zones into sqlite3 or zonefiles.
ProtectSystem=full
ProtectHome=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
[Install]
WantedBy=multi-user.target
:wq!
systemctl daemon-reload
systemctl restart pdns
@Habbie Done. I'm keeping this issue open until the merge of https://github.com/systemd/systemd/pull/4061 into systemd
.
Hum, it will be released in systemd 232.
Hi,
With pdns 4.0.1 on ArchLinux.
pdns_control
does not answer at all or rarely.My almost working
systemd
file:The default broken
systemd
file I don't use because of https://github.com/PowerDNS/pdns/issues/4180 and https://github.com/PowerDNS/pdns/issues/2307:My anonymised
/etc/powerdns/pdns.conf
:How to fix this issue ("Timeout error: Error from remote in receive(): Resource temporarily unavailable")?
Thanks, HLFH