Hi,
I'd start by checking if the file
*/var/named/dynamic/managed-keys.bind.jnl* already exists and has the
correct ownership and permissions.
If that's OK, you might want to check your audit log (journalctl or
/var/log/audit/audit.log), look for "apparmor.*DENIED'.
Also check that your 'named' process is actually running as 'bind' user
- on my distribution, it's running as '*named*':
# ps auwx | grep named
*named* 19845 0.4 3.2 966932 63832 ? Ssl avg18 11:31
/usr/sbin/named -u named -4
Permission denied is almost certainly a message from the operating
system, not from named.
D.
On 19.08.26 20:43, Xavier Humbert via bind-users wrote:
Hi, my DNS server is working perfectly, passes all the tests, but I
started to notice this in the logs
root@aragorn:/var/named# ll /var/named/dynamic/
total 0
root@aragorn:/var/named# systemctl restart named
root@aragorn:/var/named# systemctl status named
● named.service - BIND Domain Name Server
Loaded: loaded (/usr/lib/systemd/system/named.service; enabled;
preset: enabled)
Active: active (running) since Wed 2026-08-19 20:30:55 CEST; 3s ago
Docs: man:named(8)
Main PID: 178757 (named)
Status: "running"
Tasks: 10 (limit: 2216)
Memory: 25.5M (peak: 26.5M)
CPU: 607ms
CGroup: /system.slice/named.service
└─178757 /usr/sbin/named -f -u bind
Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started named.service
- BIND Domain Name Server.
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.011 general: notice: all zones loaded
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 general: error: /var/named/dynamic/managed-keys.bind.jnl:
create: permission denied
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 general: error: managed-keys-zone:
sync_keyzone:dns_journal_open -> unexpected error
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 dnssec: error: managed-keys-zone: unable to synchronize
managed keys: unexpected error
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 dnssec: error: failed to initialize managed-keys for view
_default (unexpected error): DNSSEC validation is at risk
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending notifies
(serial 2026028370)
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.013 general: notice: running
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies
(serial 2026010801)
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending notifies
(serial 2026010801)
root@aragorn:/var/named# ll -a /var/named/
total 12
drwxr-xr-x 3 bind bind 4096 Nov 29 2023 ./
drwxr-xr-x 16 root root 4096 Dec 24 2024 ../
drwxr-xr-x 2 bind bind 4096 Nov 29 2023 dynamic/
Here are my options :
options {
listen-on port 53 { 127.0.0.1; any;};
listen-on-v6 port 53 { ::1; any;};
listen-on { 127.0.0.1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
recursing-file "/var/named/data/named.recursing";
secroots-file "/var/named/data/named.secroots";
allow-query { localhost; };
recursion no;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
auth-nxdomain no; # conform to RFC1035
allow-transfer { none; };
allow-recursion { xavhome; };
version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial";
};
What is the problem ? Permissions seem OK
This is an Ubuntu 22.04.4 Server LTS
Thanks,
Regards,
Xavier
Lep pozdrav / Best regards,
--
Danilo Godec | Sistemska podpora / System Administration
AGENDA d.o.o. | Ul. Pohorskega bataljona 49, Sl-2000 Maribor
E: [email protected] | T: +386 (0)2 421 61 31
Agenda OpenSystems <https://www.agenda.si/> | Največji slovenski
odprtokodni integrator
Red Hat v Sloveniji <http://www.redhat.si/> | Red Hat Premier Business
Partner
ElasticBox <http://elasticbox.eu/> | Poslovne rešitve v oblaku
Agenda d.o.o. <https://www.agenda.si/>
Izjava o omejitvi odgovornosti / Legal disclaimer statement
<https://www.agenda.si/index.php?id=228>
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list.
