Cause:
The named initscript checks only the existence of rndc.key file on the server start-up.
Consequence:
User having a custom rndc configuration may specify the used key in the configuration or include the key from a file. In such situation the initsctipt generates a rndc.key even if there is custom rndc configuration.
Fix:
The initscript was fixed to additionally check the existence of the rndc configuration before generating the rndc.key file.
Result:
As a result, if user has a custom rndc configuration, then the initscript will not generate a rndc.key.
Description of problem:
Feature was added in bind package (bug# 768798) which creates /etc/rndc.key (if the file /etc/rndc.key doesn't exist) when named started with init script required to run rndc commands.
However if rndc.conf file is created with rndc.key defined in it, then it will throw warning as:
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
Version-Release number of selected component (if applicable):
bind-9.8.2-0.10.rc1.el6
How reproducible:
Always
Steps to Reproduce:
- Built the /etc/rndc file with rndc.key defined and run 'rndc status'
Actual results:
No warning should be logged
Expected results:
Warning getting logged.
init.d script for named should be updated to only generate rndc.key if both rndc.key and rndc.conf do not exist. Default bind install does not provide either files, so it is still appropriate to generate a rndc.key if it does not exist. However, the existence of rndc.conf should preclude the need to generate a rndc.key file.
Additional info:
rndc -c /etc/rndc.conf status works without a warning. However, this needs to work with the standard init.d script, so 'service named status' should run without a warning.
The code snippet in question is this:
if [ ! -s /etc/rndc.key ]; then
# Generate rndc.key if doesn't exist
echo -n $"Generating /etc/rndc.key:"
if /usr/sbin/rndc-confgen -a > /dev/null 2>&1; then
chmod 640 /etc/rndc.key
chown root.named /etc/rndc.key
[ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.key
success $"/etc/rndc.key generation"
echo
else
failure $"/etc/rndc.key generation"
echo
fi
fi
The first line should be modified to be:
if [ ! -s /etc/rndc.conf -a ! -s /etc/rndc.key ]; then
Once that change is made, we can delete /etc/rndc.key and the warning goes away. Plus next time when named is restarted it will not create a new key. The above change is appropriate behavior, based on the ISC documentation that introduced the warning.
https://kb.isc.org/article/AA-00722/0/Why-does-rndc-log-warning-key-file-...-exists-but-using-default-configuration-file-rndc.conf.html
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
http://rhn.redhat.com/errata/RHBA-2014-1373.html