Package: ldap2zone Version: 0.1-7 Severity: important User: [email protected] Usertags: debian-edu
Hi We discovered this problem on a school using Debian Edu Squeeze. The whole system would stop working, and the cause was that the DNS was no longer working. The root cause was that GOSA had allowed the local school admin to enter a invalid host name entry in LDAP, and this would be passed to bind that failed to work with the broken setup. To avoid this, I believe ldap2zone should reject (filter out) invalid DNS entries, and log a warning about it in the syslog. Also, I believe Gosa should be changed to now allow such invalid names to be entered in the first place. That is the only place the local admin can get sensible feedback to avoid using invalid names. The specific problem this time was a DNS host name with underscore in it (LASERJET_4250). This broke DNS completely. Another example I saw yesterday was a MX entry with value 'mail', which should have been '10 mail' or something like that as MX entries require priority numbers as part of the MX entry. Here is the named entries in /var/log/syslog when DNS fail to start because of the underscore: May 30 09:51:25 tjener named[29509]: starting BIND 9.7.3 -4 -u bind May 30 09:51:25 tjener named[29509]: built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-dlz-postgres=no' '--with-dlz-mysql=no' '--with-dlz-bdb=yes' '--with-dlz-filesystem=yes' '--with-dlz-ldap=yes' '--with-dlz-stub=yes' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2' 'LDFLAGS=' 'CPPFLAGS=' May 30 09:51:25 tjener named[29509]: adjusted limit on open files from 1024 to 1048576 May 30 09:51:25 tjener named[29509]: found 4 CPUs, using 4 worker threads May 30 09:51:25 tjener named[29509]: using up to 4096 sockets May 30 09:51:25 tjener named[29509]: loading configuration from '/etc/bind/named.conf' May 30 09:51:25 tjener named[29509]: reading built-in trusted keys from file '/etc/bind/bind.keys' May 30 09:51:25 tjener named[29509]: using default UDP/IPv4 port range: [1024, 65535] May 30 09:51:25 tjener named[29509]: using default UDP/IPv6 port range: [1024, 65535] May 30 09:51:25 tjener named[29509]: no IPv6 interfaces found May 30 09:51:25 tjener named[29509]: listening on IPv4 interface lo, 127.0.0.1#53 May 30 09:51:25 tjener named[29509]: listening on IPv4 interface eth0, 10.0.2.2#53 May 30 09:51:25 tjener named[29509]: listening on IPv4 interface eth1, 192.168.0.254#53 May 30 09:51:25 tjener named[29509]: generating session key for dynamic DNS May 30 09:51:25 tjener named[29509]: set up managed keys zone for view _default, file 'managed-keys.bind' May 30 09:51:25 tjener named[29509]: automatic empty zone: 254.169.IN-ADDR.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 2.0.192.IN-ADDR.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 100.51.198.IN-ADDR.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 113.0.203.IN-ADDR.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 255.255.255.255.IN-ADDR.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: D.F.IP6.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 8.E.F.IP6.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 9.E.F.IP6.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: A.E.F.IP6.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: B.E.F.IP6.ARPA May 30 09:51:25 tjener named[29509]: automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA May 30 09:51:25 tjener named[29509]: command channel listening on 127.0.0.1#953 May 30 09:51:25 tjener named[29509]: zone 0.in-addr.arpa/IN: loaded serial 1 May 30 09:51:25 tjener named[29509]: dns_rdata_fromtext: /etc/bind/db.10.in-addr.arpa.:61: near 'LASERJET_4250.intern.': bad name (check-names) May 30 09:51:25 tjener named[29509]: zone 10.in-addr.arpa/IN: loading from master file /etc/bind/db.10.in-addr.arpa. failed: bad name (check-names) May 30 09:51:25 tjener named[29509]: zone 10.in-addr.arpa/IN: not loaded due to errors. May 30 09:51:25 tjener named[29509]: zone 127.in-addr.arpa/IN: loaded serial 1 May 30 09:51:25 tjener named[29509]: zone 0.168.192.in-addr.arpa/IN: loaded serial 1 May 30 09:51:25 tjener named[29509]: zone 1.168.192.in-addr.arpa/IN: loaded serial 1 May 30 09:51:25 tjener named[29509]: zone 255.in-addr.arpa/IN: loaded serial 1 May 30 09:51:25 tjener named[29509]: /etc/bind/db.intern:86: LASERJET_4250.intern: bad owner name (check-names) May 30 09:51:25 tjener named[29509]: zone intern/IN: loading from master file /etc/bind/db.intern failed: bad owner name (check-names) May 30 09:51:25 tjener named[29509]: zone intern/IN: not loaded due to errors. May 30 09:51:25 tjener named[29509]: zone subnet00.intern/IN: loaded serial 1 May 30 09:51:25 tjener named[29509]: zone subnet01.intern/IN: loaded serial 1 May 30 09:51:25 tjener named[29509]: zone localhost/IN: loaded serial 2 May 30 09:51:25 tjener named[29509]: managed-keys-zone ./IN: loading from master file managed-keys.bind failed: file not found May 30 09:51:25 tjener named[29509]: managed-keys-zone ./IN: loaded serial 0 May 30 09:51:25 tjener named[29509]: running -- Happy hacking Petter Reinholdtsen -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
