Re: bind-dlz & chroot jail
Andrew Fullford <afullfor <at> cisco.com>
2005-01-04 15:53:24 GMT
You could also try linking your named process statically. That avoids
the need to replicate and maintain assorted shared libs, although
relinking named after any system security updates is then desirable.
We're successfully running a DLZ named in a chroot jail with postgres,
but this doesn't use ODBC. Our executable is linked dynamically, but
if the postgres library is referenced before the chroot is triggered,
we would not see the same problem.
One caveat is that on some operating systems (eg Solaris), it is
effectively impossible to link network apps statically.
Andy
On Jan 3, 2005, at 6:51 PM, Rob Butler wrote:
> Hello all,
>
> In addition to the odbc config files you need to make
> sure that any ODBC library files and the drivers for
> your ODBC database are accessible from the chroot
> jail. Someone suggested to trace the program when its
> running to see what its failing on. This is exactly
> what you should do to see what the application can't
> get that it needs.
>
>
> As for the not connecting to mysql on startup, that
> came up on the list before. You may have a race
> condition. Basically the MySQL server is either not
> started until after DLZ attempts to start, or if the
> MySQL server is started it is not creating the pipe
> before DLZ attempts to use it. To correct this, first
> make sure the startup script for MySQL is called
> before the startup script for DLZ. Then add a call to
> sleep in the DLZ startup script BEFORE DLZ is started.
> Make the sleep like 3 or 5 seconds. This will give
> MySQL time to startup and create the pipe before DLZ
> attempts to use it. Then everything should work fine.
>
> Oh, and be sure that your permissions on the pipe are
> correct. If you start DLZ from a script it probably
> starts as a BIND user. But if you start it as root,
> you might be giving Bind rootly privleges, and then it
> can access the pipe. Just double check the
> permissions on your pipe.
>
> Later
> Rob
> --- Andy Shinn <andys <at> lglan.net> wrote:
>
>> I have a similar problem connecting to the mysq db.
>> But only at system
>> boot it fails. If I login as root and start named
>> manually it connects
>> and starts fine. This is FreeBSD 5.3. Next I will be
>> testing this on
>> FreeBSD 4-STABLE (4.10 now?).
>>
>> -Andy
>>
>> Mitchel Constantin wrote:
>>
>>> I get the same error doing this with MySQL as well,
>> I did a symobolic
>>> link in the jail for the mysql.sock and chmodded it
>> 777 for testing
>>> purposes but no difference. I can even detect
>> packets, I wish that
>>> error was more explanatory about why it can't
>> connect.
>>>
>>> Mitchel
>>>
>>>
>>> On Fri, 31 Dec 2004 11:25:49 -0400, Andrew R
>> <jcoder24 <at> socamail.com> wrote:
>>>
>>>
>>>> Hi
>>>>
>>>> I've installed the dlz patched bind 9 configured
>> with odbc support in a chroot jail. When trying to
>> start named I am getting the following error:
>>>>
>>>> Odbc driver unable to connect
>>>> Odbc driver failed to create database connection
>> after 3 attempts
>>>>
>>>> NB. I have both odbc.ini and odbcinst.ini in the
>> chroot jail. What else do I need to do to get it
>> running?
>>>>
>>>> Thanks in advance.
>>>>
>>>> Andrew
>>>>
>>
>>> ________________________________________________________________
>>>> Sent via the WebMail system at socamail.com
>>>>
>>
>>> -------------------------------------------------------
>>>> The SF.Net email is sponsored by: Beat the
>> post-holiday blues
>>>> Get a FREE limited edition SourceForge.net t-shirt
>> from ThinkGeek.
>>>> It's fun and FREE -- well,
>> almost....http://www.thinkgeek.com/sfshirt
>>>> _______________________________________________
>>>> Bind-dlz-testers mailing list
>>>> Bind-dlz-testers <at> lists.sourceforge.net
>>
>>> https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers
>>>>
>>>>
>>>>
>>>
>>>
>>
>> -------------------------------------------------------
>>> The SF.Net email is sponsored by: Beat the
>> post-holiday blues
>>> Get a FREE limited edition SourceForge.net t-shirt
>> from ThinkGeek.
>>> It's fun and FREE -- well,
>> almost....http://www.thinkgeek.com/sfshirt
>>> _______________________________________________
>>> Bind-dlz-testers mailing list
>>> Bind-dlz-testers <at> lists.sourceforge.net
>>
>> https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers
>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>
> -------------------------------------------------------
>> The SF.Net email is sponsored by: Beat the
>> post-holiday blues
>> Get a FREE limited edition SourceForge.net t-shirt
>> from ThinkGeek.
>> It's fun and FREE -- well,
>> almost....http://www.thinkgeek.com/sfshirt
>> _______________________________________________
>> Bind-dlz-testers mailing list
>> Bind-dlz-testers <at> lists.sourceforge.net
>>
> https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers
>>
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Send holiday email and support a worthy cause. Do good.
> http://celebrity.mail.yahoo.com
>
>
> -------------------------------------------------------
> The SF.Net email is sponsored by: Beat the post-holiday blues
> Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
> It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
> _______________________________________________
> Bind-dlz-testers mailing list
> Bind-dlz-testers <at> lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers
-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
RSS Feed