DNS Resolver (unbound) / Can't change config

shlazzer

Just ran into this on 2.3.4-RELEASE (amd64)

Haven't had a chance to try any of the suggestions earlier in the thread, but this is a relatively new box that hasn't been around long enough to have legacy configs. Has always been on a 2.3.x release.

A confirmed solution would be really helpful.

yarick123

@Veldkornet:

…
The below does indeed work once off, so I need to run it every time I change the configuration.
mkdir /var/unbound/test/
cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
Is there a bug logged for it already?

works for me.

compdoc

This just happened to me, although my error was "/var/unbound/test/root.key" does not exist. I tried creating the test directory and copying the root.key there, but there was no change. I still couldn't save the settings for DNS Resolver.

However, I seemed to fix it by running the command: unbound-control-setup

I'd be interested to hear if this helped anyone else.

Gertjan

This issue is known, as the thread implies.
But 2.3.5 is old and fading out : 32 hardware is hard to find these days - some devices are kept artificially alive, mostly in museums.
Consider the issue as closed.

compdoc

I am running 64 bit, 2.4.4-RELEASE-p1

Gertjan

In that case, the issue is totally new - not related to what happened as described 2 years ago - with old pfSense versions.

Maybe some left-overs from an ancient install ?
Did you install 2.4.4-P1 from scratch, or did you upgrade from an older version ?

zimt

very same issue here, brand new hardware, latest version 2.4.4 from scratch, no import of former config

johnpoz

Same issue? From a thread from 2 years ago... Please post your exact error your seeing.. What else your running other than clean out of the box pfsense.

zimt

When I try to change any settings in unbound I get this error message, can't even disable it :

The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1550262886] unbound-checkconf[60539:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

My install worked fine for maybe two weeks, this issue just appeared. Not sure what this is related to.
I did disable pfb_dnsbl and pfb_filter but that didn't solve the issue. Also all the other tricks mentioned in this thread didn't work for me. Didn't try to reboot yet, hopefully tonight...

Here are all the services running:

Service 	Description 	
avahi 	Avahi mDNS/DNS-SD daemon 	
dhcpd 	DHCP Service 	
dpinger 	Gateway Monitoring Daemon 	
ntopng 	ntopng Network Traffic Monitor 	
ntpd 	NTP clock sync 	
openvpn 	OpenVPN server: home 	
pfb_dnsbl 	pfBlockerNG DNSBL service 	
pfb_filter 	pfBlockerNG firewall filter service 	
radvd 	Router Advertisement Daemon 	
snort 	Snort IDS/IPS Daemon 	
sshd 	Secure Shell Daemon 	
syslogd 	System Logger Daemon 	
telegraf 	Telegraf daemon 	
unbound 	DNS Resolver

johnpoz

@zimt said in DNS Resolver (unbound) / Can't change config:

I did disable pfb_dnsbl and pfb_filter

So its not a clean install, you have atleast that package installed. What else? I see avahi, ntop, snort --> So clearly its not related to a problem from 2 years ago.

I would suggest you open a thread in the pfblocker section and yell for @BBcan177 because more likely then not its related to your unbound problem.

RonpfS

Well pfblockerNG operate with the assumption that things are in /var/unbound/
Disable DNSBL then see if your mod works.

zimt

I disabled both, pfb_dnsbl and pfb_filter, that didn't help. I don't think it has anything to do with it.

RonpfS

Disabling the pfblockerng services doesn't disable DNSBL.

RonpfS

@zimt said in DNS Resolver (unbound) / Can't change config:

I don't think it has anything to do with it.

DNSBL modify unbound.conf.

zimt

rebooting resolved the issue, hope it doesn't reappear.

RonpfS

That's one way to recreate the root.key

zimt

doing it manually as indicated higher up in this thread didn't solve the problem for me.

BBcan177

@zimt said in DNS Resolver (unbound) / Can't change config:

When I try to change any settings in unbound I get this error message, can't even disable it :
The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1550262886] unbound-checkconf[60539:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

Try to run the following command to rebuild the missing root.key file:

unbound-anchor -a /var/unbound/root.key

apara

I am having exactly the same issue on the latest 2.4.4-RELEASE-p3 (amd64). When I go to change the DNS Resolver configuration, just pressing Save without any changes produces:

The following input errors were detected:

The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1561931530] unbound-checkconf[36495:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

For some reason, it feels that the *.pem and *.key files are not being copied from the parent directory as they definitely exist in the /var/unbound directory.

Does anyone have a solution?

RusG3G

I am also getting this error in a brand new SG5100;

The following input errors were detected:

The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1572274588] unbound-checkconf[68733:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

I ran "unbound-anchor -a /var/unbound/root.key" rebooted and the issue is resolved