Re: unbound doesn't remove pidfile
From what I can see unbound init script is up-to-date. Do I need to add
override for the pidfile in unbound config? Even if I do that and it works, I
will still need to update the unbound init script as well so the easiest file
to me to update the init script to explicitly remove the pid file after unbound
is stopped. I wonder how other people running unbound in a chroot setup on
ubuntu/debian is dealing with the issue.
root@DFW01-CPS02:/etc/unbound/unbound.conf.d# cat test.conf
server:
chroot: "/var/lib/unbound"
verbosity: 9
do-not-query-localhost: no
statistics-cumulative: yes
extended-statistics: yes
interface: 127.0.0.1
python:
remote-control:
control-enable: yes
root@DFW01-CPS02:/etc/unbound/unbound.conf.d#
root@DFW01-CPS02:/etc/unbound/unbound.conf.d# cat /etc/init.d/unbound
#!/bin/sh
### BEGIN INIT INFO
# Provides: unbound
# Required-Start: $network $remote_fs $syslog
# Required-Stop: $network $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
### END INIT INFO
NAME="unbound"
DESC="DNS server"
DAEMON="/usr/sbin/unbound"
PIDFILE="/run/unbound.pid"
HELPER="/usr/lib/unbound/package-helper"
test -x $DAEMON || exit 0
. /lib/lsb/init-functions
# Override this variable by editing or creating /etc/default/unbound.
DAEMON_OPTS=""
if [ -f /etc/default/unbound ]; then
. /etc/default/unbound
fi
case "$1" in
start)
log_daemon_msg "Starting $DESC" "$NAME"
$HELPER chroot_setup
$HELPER root_trust_anchor_update 2>&1 | logger -p daemon.info -t
unbound-anchor
if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --name
$NAME --startas $DAEMON -- $DAEMON_OPTS; then
$HELPER resolvconf_start
log_end_msg 0
else
log_end_msg 1
fi
;;
stop)
log_daemon_msg "Stopping $DESC" "$NAME"
if start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE --name
$NAME; then
$HELPER resolvconf_stop
log_end_msg 0
else
log_end_msg 1
fi
;;
restart|force-reload)
log_daemon_msg "Restarting $DESC" "$NAME"
start-stop-daemon --stop --quiet --pidfile $PIDFILE --name $NAME
--retry 5
$HELPER resolvconf_stop
if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --name
$NAME --startas $DAEMON -- $DAEMON_OPTS; then
$HELPER chroot_setup
$HELPER resolvconf_start
log_end_msg 0
else
log_end_msg 1
fi
;;
reload)
log_daemon_msg "Reloading $DESC" "$NAME"
if start-stop-daemon --stop --pidfile $PIDFILE --signal 1; then
$HELPER chroot_setup
log_end_msg 0
else
log_end_msg 1
fi
;;
status)
status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $?
;;
*)
N=/etc/init.d/$NAME
echo "Usage: $N {start|stop|restart|status|reload|force-reload}" >&2
exit 1
;;
esac
exit 0
On Wednesday, March 7, 2018, 4:33:37 AM PST, Robert Edmonds via
Unbound-users wrote:
Shawn Zhou via Unbound-users wrote:
> I am running unbound 1.5.8 on ubuntu xenial. unbound doesn't run remove the
> pid file after it's stopped.
I believe the unbound packaging on Ubuntu xenial is old enough that it
still uses the sysv generator to create the service unit. You will
probably want to add this fix to your unbound init script, which I don't
think was ever backported to xenial (it was originally added in 1.5.9-1):
https://salsa.debian.org/dns-team/unbound/commit/1c139abaa0fe58f8d97b64c96da6c3332b1b9e49
--
Robert Edmonds
edmo...@debian.org
Re: unbound doesn't remove pidfile
Shawn Zhou via Unbound-users wrote: > I am running unbound 1.5.8 on ubuntu xenial. unbound doesn't run remove the > pid file after it's stopped. I believe the unbound packaging on Ubuntu xenial is old enough that it still uses the sysv generator to create the service unit. You will probably want to add this fix to your unbound init script, which I don't think was ever backported to xenial (it was originally added in 1.5.9-1): https://salsa.debian.org/dns-team/unbound/commit/1c139abaa0fe58f8d97b64c96da6c3332b1b9e49 -- Robert Edmonds edmo...@debian.org
Re: unbound doesn't remove pidfile
Hi Shawn,
Unbound tries to remove the pidfile on exit. It also tries to chown it,
if the username is set in unbound.conf.
Also if the pidfile is not located inside the chroot, then unbound
cannot remove the pidfile itself.
Best regards, Wouter
On 07/03/18 03:03, Shawn Zhou via Unbound-users wrote:
> Hi,
>
> I am running unbound 1.5.8 on ubuntu xenial. unbound doesn't run remove
> the pid file after it's stopped. I was expecting the pid file should be
> owned by unbound user as otherwise unbound probably wouldn't be able to
> remove it; however, I didn't see any permission errors from unbound
> logs. I even tried to changed the permission of the pid file after it's
> created before stopping unbound that didn't help.
>
> root@DFW01-CPS02:~# service unbound start
> * Starting DNS server unbound
> [1520387664] unbound[60481:0] debug: increased limit(open files) from
> 1024 to 4140
> [1520387664] unbound[60481:0] debug: creating udp4 socket 127.0.0.1 53
> [1520387664] unbound[60481:0] debug: creating tcp4 socket 127.0.0.1 53
> [1520387664] unbound[60481:0] debug: creating tcp6 socket ::1 8953
> [1520387664] unbound[60481:0] debug: creating tcp4 socket 127.0.0.1 8953
> [1520387664] unbound[60481:0] debug: switching log to syslog
> ...done.
> root@DFW01-CPS02:~# ls -l /run/unbound.pid
> -rw-r--r-- 1 root root 6 Mar 7 01:54 /run/unbound.pid
> root@DFW01-CPS02:~# cat /run/unbound.pid
> 60482
> root@DFW01-CPS02:~# ps -ef |grep unbound
> root 60455 58318 0 01:54 pts/4 00:00:00 grep --color=auto -i
> unbound
> unbound 60482 1 0 01:54 ? 00:00:00 /usr/sbin/unbound
> root 60599 57970 0 01:55 pts/3 00:00:00 grep --color=auto unbound
> root@DFW01-CPS02:~#
> root@DFW01-CPS02:~# service unbound stop
> * Stopping DNS server unbound
> ...done.
> root@DFW01-CPS02:~# cat /run/unbound.pid
> 60482
> root@DFW01-CPS02:~# ps -ef |grep unbound
> root 60455 58318 0 01:54 pts/4 00:00:00 grep --color=auto -i
> unbound
> root 60627 57970 0 01:55 pts/3 00:00:00 grep --color=auto unbound
> root@DFW01-CPS02:~#
> root@DFW01-CPS02:~# dpkg -l unbound
> Desired=Unknown/Install/Remove/Purge/Hold
> |
> Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
> |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
> ||/ Name Version Architecture
> Description
> +++-===-==-==-
> ii unbound 1.5.8-1ubuntu1 amd64
> validating, recursive, caching DNS resolver
>
>
>
> Here are the log messages from unbound:
> root@DFW01-CPS02:~# tail -n 0 -f /var/log/messages | grep -i unbound
> Mar 7 01:54:24 DFW01-CPS02 unbound-anchor: /var/lib/unbound/root.key
> has content
> Mar 7 01:54:24 DFW01-CPS02 unbound-anchor: success: the anchor is ok
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60481:0] debug: setup SSL certificates
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: chdir to
> /var/lib/unbound
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: chroot to
> /var/lib/unbound
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: chdir to /etc/unbound
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: drop user
> privileges, run as unbound
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: module config:
> "validator iterator"
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] notice: init module 0:
> validator
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: reading autotrust
> anchor file /root.key
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: trust point . : 1
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: assembled 0 DS and
> 2 DNSKEYs
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: DNSKEY::
> .#011172800#011IN#011DNSKEY#011257 3 8
> AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=
> ;{id = 19036 (ksk), size = 2048b}
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: DNSKEY::
> .#011172800#011IN#011DNSKEY#011257 3 8
> AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
> ;{id = 20326 (ksk), size = 2048b}
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: file /root.key
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: last_queried:
> 1520387664 Wed Mar 7 01:54:24 2018
> Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: las
unbound doesn't remove pidfile
Hi,
I am running unbound 1.5.8 on ubuntu xenial. unbound doesn't run remove the pid
file after it's stopped. I was expecting the pid file should be owned by
unbound user as otherwise unbound probably wouldn't be able to remove it;
however, I didn't see any permission errors from unbound logs. I even tried to
changed the permission of the pid file after it's created before stopping
unbound that didn't help.
root@DFW01-CPS02:~# service unbound start
* Starting DNS server unbound
[1520387664] unbound[60481:0] debug: increased limit(open files) from 1024 to
4140
[1520387664] unbound[60481:0] debug: creating udp4 socket 127.0.0.1 53
[1520387664] unbound[60481:0] debug: creating tcp4 socket 127.0.0.1 53
[1520387664] unbound[60481:0] debug: creating tcp6 socket ::1 8953
[1520387664] unbound[60481:0] debug: creating tcp4 socket 127.0.0.1 8953
[1520387664] unbound[60481:0] debug: switching log to syslog
...done.
root@DFW01-CPS02:~# ls -l /run/unbound.pid
-rw-r--r-- 1 root root 6 Mar 7 01:54 /run/unbound.pid
root@DFW01-CPS02:~# cat /run/unbound.pid
60482
root@DFW01-CPS02:~# ps -ef |grep unbound
root 60455 58318 0 01:54 pts/4 00:00:00 grep --color=auto -i unbound
unbound 60482 1 0 01:54 ? 00:00:00 /usr/sbin/unbound
root 60599 57970 0 01:55 pts/3 00:00:00 grep --color=auto unbound
root@DFW01-CPS02:~#
root@DFW01-CPS02:~# service unbound stop
* Stopping DNS server unbound
...done.
root@DFW01-CPS02:~# cat /run/unbound.pid
60482
root@DFW01-CPS02:~# ps -ef |grep unbound
root 60455 58318 0 01:54 pts/4 00:00:00 grep --color=auto -i unbound
root 60627 57970 0 01:55 pts/3 00:00:00 grep --color=auto unbound
root@DFW01-CPS02:~#root@DFW01-CPS02:~# dpkg -l unbound
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture
Description
+++-===-==-==-
ii unbound 1.5.8-1ubuntu1 amd64
validating, recursive, caching DNS resolver
Here are the log messages from unbound:root@DFW01-CPS02:~# tail -n 0 -f
/var/log/messages | grep -i unbound
Mar 7 01:54:24 DFW01-CPS02 unbound-anchor: /var/lib/unbound/root.key has
content
Mar 7 01:54:24 DFW01-CPS02 unbound-anchor: success: the anchor is ok
Mar 7 01:54:24 DFW01-CPS02 unbound: [60481:0] debug: setup SSL certificates
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: chdir to /var/lib/unbound
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: chroot to /var/lib/unbound
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: chdir to /etc/unbound
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: drop user privileges, run
as unbound
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: module config: "validator
iterator"
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] notice: init module 0: validator
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] debug: reading autotrust anchor
file /root.key
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: trust point . : 1
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: assembled 0 DS and 2
DNSKEYs
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: DNSKEY::
.#011172800#011IN#011DNSKEY#011257 3 8
AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=
;{id = 19036 (ksk), size = 2048b}
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: DNSKEY::
.#011172800#011IN#011DNSKEY#011257 3 8
AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
;{id = 20326 (ksk), size = 2048b}
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: file /root.key
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: last_queried: 1520387664
Wed Mar 7 01:54:24 2018
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: last_success: 1520387664
Wed Mar 7 01:54:24 2018
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: next_probe_time:
1520427614 Wed Mar 7 13:00:14 2018
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: query_interval: 43200
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: retry_time: 8640
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: query_failed: 0
Mar 7 01:54:24 DFW01-CPS02 unbound: [60482:0] info: [ VALID ]
.#011172800#011IN#011DNS
