DNS Resolver (unbound) / Can't change config
-
Works only once: every time /var/unbound/test/ is deleted and I have to create again before saving settings
-
No idea what kind of legacy configuration crap have you imported on all of your boxes across some upgrades, sorry. You can try with 2.3.3 but I sincerely doubt it'd change anything. Other that that
- wipe /var/unbound altogether
- switch to DNS forwarder
- make a config backup, wipe everything between <unbound>…</unbound> tags, restore the config (will force a reboot)
- reconfigure the resolver from from scratch
-
Works only once: every time /var/unbound/test/ is deleted and I have to create again before saving settings
Same here too.
_The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/unbound_server.key: No such file or directory
[1484738643] unbound-checkconf[70766:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist_I have to execute this everytime there are changes to be made:
_ mkdir /var/unbound/test/
cp -ax /var/unbound/*.{key,pem} /var/unbound/test/_I am also getting this error on DNS Resolver log: (a lot of them)
notice: remote address is 192.168.2.245 port 53134
notice: sendmsg failed: No buffer space available -
Not sure where this /test dir is coming from.. I look on my /var/unbound dir and I don't see any test dir..
I can change my unbound conf without any issues.
Are you running 2.3.3 or 2.4 of pfsense??
-
I am currently using 2.3.2-RELEASE-p1
-
So from the code it looks like that sub dir is created but then removed after the test
function test_unbound_config($unboundcfg, &$output) { global $g; $cfgsubdir = "/test"; unbound_generate_config($unboundcfg, $cfgsubdir); unbound_remote_control_setup($cfgsubdir); do_as_unbound_user("unbound-anchor", $cfgsubdir); $cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}"; $rv = 0; exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv); rmdir_recursive($cfgdir); return $rv; }
rmdir_recursive($cfgdir);
So something is failing here? Just not sure what..
-
I'm also having this problem. Setup pfSense from scratch on 2.3.3_p1.
The below does indeed work once off, so I need to run it every time I change the configuration.
mkdir /var/unbound/test/ cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
Is there a bug logged for it already?
-
For me the problem is gone away and I did nothing (neither reboot).
After updating to 2.3.3-p1 everything is still working.But now is happening again on another site with a fresh new installation of a 2.3.3-p1 ???
-
Ok, now I have the problem again.
Sometimes happens and usually a reboot fixes it. -
Just want to chime in here. Starting to see this on my pfsense running 2.3.3-RELEASE-p1 (amd64)
Configuration created from scratch so no "old crap" should be there. The workaround with mkdir and cp works.
Reboot doesn't solve this. -
So to Recap:
-
Reboots - DO NOT WORK
-
mkdir Test and cp config - Works once per saved change
-
move to forwarder, wipe unbound directory and return to resolver - ? ? ? ? ?
Anymore suggestions
This is the message I get when making any changes
The following input errors were detected: The generated config file cannot be parsed by unbound. Please correct the following errors: /var/unbound/test/root.key: No such file or directory [1494245590] unbound-checkconf[4967:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound
I am running:
2.3.4-RELEASE (amd64) built on Wed May 03 15:13:29 CDT 2017 FreeBSD 10.3-RELEASE-p19 The system is on the latest version.
HELP!!!
-
-
Let me add to my previous, DNS is resolving all local addresses and appears to be working correctly.
But even if I attempt to make changes directly to the dhcp.conf, hostentries.conf or dhcpleases_entries.conf the changes to not persist after a process restart.So this unbound config validator issue I more spread than I thought and more annoying than willing to deal with.
-
I'm facing this problem too, although not been able to clearly determine when and what triggers this.
Depending on DNS configuration (but what?), I get this same error message.
As far as I remember, occurred with all 2.3.x version (currently running 2.3.4)I'm also facing problem with, if I'm not wrong, DNS stopping from time to time when DHCP registration is activated.
Weird :(
-
Created redmine ticket:
https://redmine.pfsense.org/issues/7600
Running this command lets me do it before each save:
echo 'mkdir /var/unbound/test; /usr/local/sbin/unbound-control-setup -d /var/unbound/test' | /usr/bin/su -m unbound
-
This is not a general problem that happens out of the box or with anything I have readily available. Something specific to your setups is causing this, but it's not clear yet what that is.
There must be some missing detail to reliably replicate it. Please compare other system settings and setup details, like what platform/architecture is in use (e.g. NanoBSD or full), if you have /var and /tmp in RAM disks, and anything else about the setup that might be different or unusual, especially any packages you have installed.
-
I remember few days ago after clean install of 2.3.4, and right after I restored 2.3.2 config, unbound was down and did not wanted to start up until I deleted the line added by pfblocker…```
server:include: /var/unbound/pfb_dnsbl.confToday I found unbound dead… and I blame wan lose connection that also triggered unbound death. https://forum.pfsense.org/index.php?topic=131242.msg723850#msg723850
-
I have also just faced this problem on my 2.3.5-RELEASE-p1 (i386) nanobsd (2g). Interesting is, that adding Host Overrides does not trigger the problem, although it changes and saves DNS Resolver configuration.
-
Just ran into this on 2.3.4-RELEASE (amd64)
Haven't had a chance to try any of the suggestions earlier in the thread, but this is a relatively new box that hasn't been around long enough to have legacy configs. Has always been on a 2.3.x release.
A confirmed solution would be really helpful.
-
…
The below does indeed work once off, so I need to run it every time I change the configuration.mkdir /var/unbound/test/ cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
Is there a bug logged for it already?
works for me.
-
This just happened to me, although my error was "/var/unbound/test/root.key" does not exist. I tried creating the test directory and copying the root.key there, but there was no change. I still couldn't save the settings for DNS Resolver.
However, I seemed to fix it by running the command: unbound-control-setup
I'd be interested to hear if this helped anyone else.
-
This issue is known, as the thread implies.
But 2.3.5 is old and fading out : 32 hardware is hard to find these days - some devices are kept artificially alive, mostly in museums.
Consider the issue as closed. -
I am running 64 bit, 2.4.4-RELEASE-p1
-
In that case, the issue is totally new - not related to what happened as described 2 years ago - with old pfSense versions.
Maybe some left-overs from an ancient install ?
Did you install 2.4.4-P1 from scratch, or did you upgrade from an older version ? -
very same issue here, brand new hardware, latest version 2.4.4 from scratch, no import of former config
-
Same issue? From a thread from 2 years ago... Please post your exact error your seeing.. What else your running other than clean out of the box pfsense.
-
When I try to change any settings in unbound I get this error message, can't even disable it :
The following input errors were detected: The generated config file cannot be parsed by unbound. Please correct the following errors: /var/unbound/test/root.key: No such file or directory [1550262886] unbound-checkconf[60539:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound
My install worked fine for maybe two weeks, this issue just appeared. Not sure what this is related to.
I did disable pfb_dnsbl and pfb_filter but that didn't solve the issue. Also all the other tricks mentioned in this thread didn't work for me. Didn't try to reboot yet, hopefully tonight...Here are all the services running:
Service Description avahi Avahi mDNS/DNS-SD daemon dhcpd DHCP Service dpinger Gateway Monitoring Daemon ntopng ntopng Network Traffic Monitor ntpd NTP clock sync openvpn OpenVPN server: home pfb_dnsbl pfBlockerNG DNSBL service pfb_filter pfBlockerNG firewall filter service radvd Router Advertisement Daemon snort Snort IDS/IPS Daemon sshd Secure Shell Daemon syslogd System Logger Daemon telegraf Telegraf daemon unbound DNS Resolver
-
@zimt said in DNS Resolver (unbound) / Can't change config:
I did disable pfb_dnsbl and pfb_filter
So its not a clean install, you have atleast that package installed. What else? I see avahi, ntop, snort --> So clearly its not related to a problem from 2 years ago.
I would suggest you open a thread in the pfblocker section and yell for @BBcan177 because more likely then not its related to your unbound problem.
-
Well pfblockerNG operate with the assumption that things are in /var/unbound/
Disable DNSBL then see if your mod works. -
I disabled both, pfb_dnsbl and pfb_filter, that didn't help. I don't think it has anything to do with it.
-
Disabling the pfblockerng services doesn't disable DNSBL.
-
@zimt said in DNS Resolver (unbound) / Can't change config:
I don't think it has anything to do with it.
DNSBL modify unbound.conf.
-
rebooting resolved the issue, hope it doesn't reappear.
-
That's one way to recreate the root.key
-
doing it manually as indicated higher up in this thread didn't solve the problem for me.
-
@zimt said in DNS Resolver (unbound) / Can't change config:
When I try to change any settings in unbound I get this error message, can't even disable it :
The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1550262886] unbound-checkconf[60539:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unboundTry to run the following command to rebuild the missing root.key file:
unbound-anchor -a /var/unbound/root.key
-
I am having exactly the same issue on the latest 2.4.4-RELEASE-p3 (amd64). When I go to change the DNS Resolver configuration, just pressing Save without any changes produces:
The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1561931530] unbound-checkconf[36495:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unboundFor some reason, it feels that the *.pem and *.key files are not being copied from the parent directory as they definitely exist in the /var/unbound directory.
Does anyone have a solution?
-
I am also getting this error in a brand new SG5100;
The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1572274588] unbound-checkconf[68733:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unboundI ran "unbound-anchor -a /var/unbound/root.key" rebooted and the issue is resolved
-
@RusG3G in my case, I rebooted the firewall and all was good again... Sorry, don't have more details.
-
Also now affected.
This seems really bizarre problem.
Some information.
The problem does "not" occur when my custom unbound configuration is included which I normally do include, but I wanted to revert to solely a auto generated config which in theory is safer but generated the error, if I include my config again, the error is gone eve though I dont configure anything related to the keys.
The 2 commands listed in the thread dont fix anything.
The keys do exist in my /var/unbound, and are dated 2017 so have been there 2 years.
The following commands enabled me to use the save function in the GUI.
cd /var/unbound
cp unbound_server.* test
cp unbound_control.* test
chflags schg /var/unbound/test/unbound_server.*
chflags schg /var/unbound/test/unbound_control.*So basically I manually copy the keys to the test folder, I set the files to be unable to be overwritten and bam it works.
So some kind of script when hitting save is not working as it should.
I do have pfblockerng installed but I would be very surprised if thats breaking this.
-
@BBcan177 said in DNS Resolver (unbound) / Can't change config:
Try to run the following command to rebuild the missing root.key file:
unbound-anchor -a /var/unbound/root.keyThis and a reboot helped me. SG-2440
Edit. 2.4.5-Release.