10.04 upgrade on bind in chroot crash

[puppykhan]

I just tried to upgrade my server to the latest version of Bind9 and the process fails gets frozen.

First note that I have Bind in a chroot jail.

When I try the upgrade, or the recommended "dpkg --configure -a", it displays this then hangs:



Setting up bind9 (1:9.7.0.dfsg.P1-1ubuntu0.1) ...
* Stopping domain name service... bind9 rndc: connection to remote host closed
This may indicate that
* the remote server is using an older version of the command protocol,
* this host is not authorized to connect,
* the clocks are not synchronized, or
* the key is invalid.
doing ps from another terminal reveals that the restart and stop commands are frozen. Killing those processes frees the terminal.

I tried copying my OPTIONS from:


/etc/default/bind9to:


/etc/default/bind9.dpkg-distAnd I also tried starting the process manually. Doing so gives the following error:


named: chroot(): Permission deniedHelp, my Bind is not running and the upgrade seems to be incomplete.

Thanks.


PuppyKhan

[puppykhan]

No one?

This is a serious problem. The only solution I can think of at this point is to try to uninstall Bind completely and start over. But that shouldn't be necessary and may need to be done outside of the package manager, being laborious and possibly leading to other complications.

From the symptoms, is there a script dpkg is using which tells it the steps to follow? If so then perhaps I can comment out the line asking it to try a shutdown on Bind and see if the upgrade will complete. But that is assuming the root problem is an incomplete upgrade.

Suggestions?

[puppykhan]

Figured it out. Posting solution for those hitting this in the future...

It seems it was a combination of the chroot jail needing to modify the etc script which got (I think) overwritten during the upgrade, and apparmor blocking access.

First check your /etc/init.d/bind9 script for a line near the top like:

PIDFILE=/var/run/named/named.pidMake sure this matches the location of named.pid in your chroot jail.

Once fixed, I had to put apparmor temporarily into complain mode to finish the upgrade, don't forget to set it back to enforce. I ran these three commands:


complain /usr/sbin/named
apt-get upgrade
enforce /usr/sbin/namedAnd now its all good. Off to research DNSSEC...

Some helpful references I found:
http://www.howtoforge.com/perfect-server-ubuntu-9.10-karmic-koala-ispconfig-2-p4#comment-21198
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/665264

PS - I tried to set the PIDFILE in /etc/default/bind9 but that did not appear to do anything. Shame.

PuppyKhan