Xavier, I believe Danilo Godec has given good advice,
Ultimately, rather than updating apparmor, which was an issue at my site, I moved all zone information into /var/bind/* but dynamic and static files. I did something as well with error messages, but I don’t recall what, currently all log files are under /var/log/named/ don’t recall if that was an apparmor change or I moved the files, perhaps the former but didn’t have any issues bringing up a new DNS primary without changes, so I may have just been lucky when I’d picked the patch originally. Brian Cuttler Pronouns: he, him, his (What’s This<https://oer.ny.gov/system/files/documents/2023/11/personal-pronouns.pdf>?) System and Network Administration Wadsworth Center, New York State Department of Health Room D280, Biggs Laboratory Empire State Plaza, Albany, NY 12201 (518) 486-1697 | [email protected]<mailto:[email protected]> [Wadsworth Center's logo thumbnail] www.wadsworth.org<http://www.wadsworth.org/> From: bind-users <[email protected]> On Behalf Of Danilo Godec via bind-users Sent: Thursday, August 20, 2026 1:48 AM To: [email protected] Subject: Re: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied Attention: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails. Hi, I'd start by checking if the file /var/named/dynamic/managed-keys.bind.jnl already exists and has the correct ownership and permissions. If that's OK, you might want to check your audit log (journalctl or /var/log/audit/audit.log), look for "apparmor.*DENIED'. Also check that your 'named' process is actually running as 'bind' user - on my distribution, it's running as 'named': # ps auwx | grep named named 19845 0.4 3.2 966932 63832 ? Ssl avg18 11:31 /usr/sbin/named -u named -4 Permission denied is almost certainly a message from the operating system, not from named. D. On 19.08.26 20:43, Xavier Humbert via bind-users wrote: Hi, my DNS server is working perfectly, passes all the tests, but I started to notice this in the logs root@aragorn:/var/named# ll /var/named/dynamic/ total 0 root@aragorn:/var/named# systemctl restart named root@aragorn:/var/named# systemctl status named ● named.service - BIND Domain Name Server Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; preset: enabled) Active: active (running) since Wed 2026-08-19 20:30:55 CEST; 3s ago Docs: man:named(8) Main PID: 178757 (named) Status: "running" Tasks: 10 (limit: 2216) Memory: 25.5M (peak: 26.5M) CPU: 607ms CGroup: /system.slice/named.service └─178757 /usr/sbin/named -f -u bind Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started named.service - BIND Domain Name Server. Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.011 general: notice: all zones loaded Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 general: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 general: error: managed-keys-zone: sync_keyzone:dns_journal_open -> unexpected error Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 dnssec: error: managed-keys-zone: unable to synchronize managed keys: unexpected error Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 dnssec: error: failed to initialize managed-keys for view _default (unexpected error): DNSSEC validation is at risk Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending notifies (serial 2026028370) Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.013 general: notice: running Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies (serial 2026010801) Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending notifies (serial 2026010801) root@aragorn:/var/named# ll -a /var/named/ total 12 drwxr-xr-x 3 bind bind 4096 Nov 29 2023 ./ drwxr-xr-x 16 root root 4096 Dec 24 2024 ../ drwxr-xr-x 2 bind bind 4096 Nov 29 2023 dynamic/ Here are my options : options { listen-on port 53 { 127.0.0.1; any;}; listen-on-v6 port 53 { ::1; any;}; listen-on { 127.0.0.1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; recursing-file "/var/named/data/named.recursing"; secroots-file "/var/named/data/named.secroots"; allow-query { localhost; }; recursion no; managed-keys-directory "/var/named/dynamic"; pid-file "/run/named/named.pid"; session-keyfile "/run/named/session.key"; auth-nxdomain no; # conform to RFC1035 allow-transfer { none; }; allow-recursion { xavhome; }; version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial"; }; What is the problem ? Permissions seem OK This is an Ubuntu 22.04.4 Server LTS Thanks, Regards, Xavier Lep pozdrav / Best regards, -- Danilo Godec | Sistemska podpora / System Administration AGENDA d.o.o. | Ul. Pohorskega bataljona 49, Sl-2000 Maribor E: [email protected] <mailto:[email protected]> | T: +386 (0)2 421 61 31 Agenda OpenSystems <https://www.agenda.si/> | Največji slovenski odprtokodni integrator Red Hat v Sloveniji <http://www.redhat.si/> | Red Hat Premier Business Partner ElasticBox <http://elasticbox.eu/> | Poslovne rešitve v oblaku [Agenda d.o.o.]<https://www.agenda.si/> Izjava o omejitvi odgovornosti / Legal disclaimer statement <https://www.agenda.si/index.php?id=228>
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.
