DNS Resolver (unbound) / Can't change config



  • Hi, I can change the configuration of the DNS Resolver settings, we can add Host Overrides, but no change General DNS Resolver Options. After change something when I save I get this error:

    The following input errors were detected:
    The generated config file cannot be parsed by unbound. Please correct the following errors:
    /var/unbound/test/root.key: No such file or directory
    [1473785216] unbound-checkconf[7939:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

    I have this problem on others pfSenses too. All of them and this one included are in version 2.3.2-RELEASE but they were upgraded from previous versions. I have tried to disable DNS Resolver but when I re-enable the settings persist and still can't make any change.

    The DNS Resolver is working, but now I need to add another interface and I can't.



  • Hi,

    i'am getting exactly the same error, when i make some change and save this error appear and config stay unchanged.

    tanks



  • Hi, svaldes

    try to reboot the PFsense, work with me, the error dissapear.



  • same error for me

    The following input errors were detected:
    
        The generated config file cannot be parsed by unbound. Please correct the following errors:
        /var/unbound/test/unbound_server.key: No such file or directory
        [1484640674] unbound-checkconf[16694:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist
    
    Version 	2.3.2-RELEASE-p1 (amd64)
    built on Tue Sep 27 12:13:07 CDT 2016
    FreeBSD 10.3-RELEASE-p9
    
    ##########################
    # Unbound Configuration
    ##########################
    
    ##
    # Server configuration
    ##
    server:
    
    chroot: /var/unbound
    username: "unbound"
    directory: "/var/unbound"
    pidfile: "/var/run/unbound.pid"
    use-syslog: yes
    port: 53
    verbosity: 1
    hide-identity: yes
    hide-version: yes
    harden-glue: yes
    do-ip4: yes
    do-ip6: yes
    do-udp: yes
    do-tcp: yes
    do-daemonize: yes
    module-config: "validator iterator"
    unwanted-reply-threshold: 0
    num-queries-per-thread: 4096
    jostle-timeout: 200
    infra-host-ttl: 900
    infra-cache-numhosts: 10000
    outgoing-num-tcp: 10
    incoming-num-tcp: 10
    edns-buffer-size: 4096
    cache-max-ttl: 86400
    cache-min-ttl: 0
    harden-dnssec-stripped: yes
    msg-cache-size: 4m
    rrset-cache-size: 8m
    
    num-threads: 4
    msg-cache-slabs: 4
    rrset-cache-slabs: 4
    infra-cache-slabs: 4
    key-cache-slabs: 4
    outgoing-range: 4096
    #so-rcvbuf: 4m
    auto-trust-anchor-file: /var/unbound/root.key
    prefetch: no
    prefetch-key: no
    use-caps-for-id: no
    # Statistics
    # Unbound Statistics
    statistics-interval: 0
    extended-statistics: yes
    statistics-cumulative: yes
    
    # Interface IP(s) to bind to
    interface: 0.0.0.0
    interface: ::0
    interface-automatic: yes
    
    # Outgoing interfaces to be used
    
    # DNS Rebinding
    # For DNS Rebinding prevention
    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: 169.254.0.0/16
    private-address: 192.168.0.0/16
    private-address: fd00::/8
    private-address: fe80::/10
    
    # Access lists
    include: /var/unbound/access_lists.conf
    
    # Static host entries
    include: /var/unbound/host_entries.conf
    
    # dhcp lease entries
    include: /var/unbound/dhcpleases_entries.conf
    
    # Domain overrides
    include: /var/unbound/domainoverrides.conf
    
    # Unbound custom options
    server:include: /var/unbound/pfb_dnsbl.conf
    
    ###
    # Remote Control Config
    ###
    include: /var/unbound/remotecontrol.conf
    
    

  • LAYER 8 Global Moderator

    I would guess this is your problem

    server:include: /var/unbound/pfb_dnsbl.conf

    No mention that your running pfblocker…



  • So it's a pfblocker issue?
    May I open a discussion on pfblocker thread?


  • LAYER 8 Global Moderator

    Well I am not sure that is the issue, but that would be my educated guess… Why don't you remove it and see if that fixes your problem.  If so then yes you could start a thread on the packages section.

    For starters you could look to see what is being loaded from that conf file.. Since your conf doesn't point to that key file that is saying is not there, etc.

    your says
    auto-trust-anchor-file: /var/unbound/root.key

    Error says
    /var/unbound/test/unbound_server.key" does not exist



  • The file /var/unbound/pfb_dnsbl.conf only contains a logn list of local-data/local-zone entries

    And I cannot save settings also if I remove the pfblocker include (using the gui)


  • LAYER 8 Global Moderator

    well look into any included conf files.. since fro the conf posted there is no reference to that file.



  • [2.3.2-RELEASE][admin@pfSense.arda]/var/unbound: grep -R -i unbound_server.key *
    remotecontrol.conf:	server-key-file: "/var/unbound/unbound_server.key"
    
    

    Where else can I search? Is unbound chrooted?

    [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: grep -R /unbound_server.key *
    unbound.inc:	server-key-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_server.key"
    [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: 
    
    [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: grep -R /test *
    unbound.inc:	$cfgsubdir = "/test";
    [2.3.2-RELEASE][admin@pfSense.arda]/etc/inc: 
    
    

    content of /etc/inc/unbound.inc

    function test_unbound_config($unboundcfg, &$output) {
            global $g;
    
            $cfgsubdir = "/test";
            unbound_generate_config($unboundcfg, $cfgsubdir);
            unbound_remote_control_setup($cfgsubdir);
            do_as_unbound_user("unbound-anchor", $cfgsubdir);
    
            $cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";
    
            $rv = 0;
            exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv);
            rmdir_recursive($cfgdir);
    
            return $rv;
    }
    
    

  • Banned

    Just disable DNSSEC if you cannot get it working. Are you using some kind of RAM disks or nanobsd?



  • I cannot disable DNSSEC for the same error. I'm using the full 64bit release without ramdisk.
    DNS resolver works but I cannot make any change. Reload works.


  • Banned

    Have you tried to reboot as suggested above? Also, no idea why did you use this thread since you definitely do NOT have the same error.

    Anyway.

    
    mkdir /var/unbound/test/
    cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
    
    

    and try again.



  • Works only once: every time  /var/unbound/test/ is deleted and I have to create again before saving settings


  • Banned

    No idea what kind of legacy configuration crap have you imported on all of your boxes across some upgrades, sorry. You can try with 2.3.3 but I sincerely doubt it'd change anything. Other that that

    • wipe /var/unbound altogether
    • switch to DNS forwarder
    • make a config backup, wipe everything between <unbound>…</unbound> tags, restore the config (will force a reboot)
    • reconfigure the resolver from from scratch


  • @Fabio72:

    Works only once: every time  /var/unbound/test/ is deleted and I have to create again before saving settings

    Same here too.

    _The following input errors were detected:

    The generated config file cannot be parsed by unbound. Please correct the following errors:
        /var/unbound/test/unbound_server.key: No such file or directory
        [1484738643] unbound-checkconf[70766:0] fatal error: server-key-file: "/var/unbound/test/unbound_server.key" does not exist_

    I have to execute this everytime there are changes to be made:
    _  mkdir /var/unbound/test/
      cp -ax /var/unbound/*.{key,pem} /var/unbound/test/_

    I am also getting this error on DNS Resolver log: (a lot of them)
      notice: remote address is 192.168.2.245 port 53134
      notice: sendmsg failed: No buffer space available


  • LAYER 8 Global Moderator

    Not sure where this /test dir is coming from.. I look on my /var/unbound dir and I don't see any test dir..

    I can change my unbound conf without any issues.

    Are you running 2.3.3 or 2.4 of pfsense??




  • I am currently using 2.3.2-RELEASE-p1


  • LAYER 8 Global Moderator

    So from the code it looks like that sub dir is created but then removed after the test

    
    function test_unbound_config($unboundcfg, &$output) {
    	global $g;
    	$cfgsubdir = "/test";
    	unbound_generate_config($unboundcfg, $cfgsubdir);
    	unbound_remote_control_setup($cfgsubdir);
    	do_as_unbound_user("unbound-anchor", $cfgsubdir);
    	$cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";
    	$rv = 0;
    	exec("/usr/local/sbin/unbound-checkconf {$cfgdir}/unbound.conf 2>&1", $output, $rv);
    	rmdir_recursive($cfgdir);
    	return $rv;
    }
    
    

    rmdir_recursive($cfgdir);

    So something is failing here?  Just not sure what..



  • I'm also having this problem. Setup pfSense from scratch on 2.3.3_p1.

    The below does indeed work once off, so I need to run it every time I change the configuration.

    mkdir /var/unbound/test/
    cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
    

    Is there a bug logged for it already?



  • For me the problem is gone away and I did nothing (neither reboot).
    After updating to 2.3.3-p1 everything is still working.

    But now is happening again on another site with a fresh new installation of a 2.3.3-p1  ???



  • Ok, now I have the problem again.
    Sometimes happens and usually a reboot fixes it.



  • Just want to chime in here. Starting to see this on my pfsense running 2.3.3-RELEASE-p1 (amd64)
    Configuration created from scratch so no "old crap" should be there. The workaround with mkdir and cp works.
    Reboot doesn't solve this.



  • So to Recap:

    • Reboots - DO NOT WORK

    • mkdir Test and cp config - Works once per saved change

    • move to forwarder, wipe unbound directory and return to resolver - ? ? ? ? ?

      Anymore suggestions

      This is the message I get when making any changes

      The following input errors were detected:
      The generated config file cannot be parsed by unbound. Please correct the following errors:
      /var/unbound/test/root.key: No such file or directory
      [1494245590] unbound-checkconf[4967:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound
      

      I am running:

      2.3.4-RELEASE (amd64) 
      built on Wed May 03 15:13:29 CDT 2017 
      FreeBSD 10.3-RELEASE-p19 
      
      The system is on the latest version.
      

      HELP!!!



  • Let me add to my previous, DNS is resolving all local addresses and appears to be working correctly.
    But even if I attempt to make changes directly to the dhcp.conf, hostentries.conf or dhcpleases_entries.conf the changes to not persist after a process restart.

    So this unbound config validator issue I more spread than I thought and more annoying than willing to deal with.



  • I'm facing this problem too, although not been able to clearly determine when and what triggers this.
    Depending on DNS configuration (but what?), I get this same error message.
    As far as I remember, occurred with all 2.3.x version (currently running 2.3.4)

    I'm also facing problem with, if I'm not wrong, DNS stopping from time to time when DHCP registration is activated.

    Weird  :(



  • Created redmine ticket:

    https://redmine.pfsense.org/issues/7600

    Running this command lets me do it before each save:

    echo 'mkdir /var/unbound/test; /usr/local/sbin/unbound-control-setup -d /var/unbound/test' | /usr/bin/su -m unbound
    

  • Rebel Alliance Developer Netgate

    This is not a general problem that happens out of the box or with anything I have readily available. Something specific to your setups is causing this, but it's not clear yet what that is.

    There must be some missing detail to reliably replicate it. Please compare other system settings and setup details, like what platform/architecture is in use (e.g. NanoBSD or full), if you have /var and /tmp in RAM disks, and anything else about the setup that might be different or unusual, especially any packages you have installed.



  • I remember few days ago after clean install of 2.3.4, and right after I restored 2.3.2 config, unbound was down and did not wanted to start up until I deleted the line added by pfblocker…```
    server:include: /var/unbound/pfb_dnsbl.conf

    
    Today I found unbound dead… and I blame wan lose connection that also triggered unbound death.
    https://forum.pfsense.org/index.php?topic=131242.msg723850#msg723850


  • I have also just faced this problem on my 2.3.5-RELEASE-p1 (i386) nanobsd (2g). Interesting is, that adding Host Overrides does not trigger the problem, although it changes and saves DNS Resolver configuration.



  • Just ran into this on 2.3.4-RELEASE (amd64)

    Haven't had a chance to try any of the suggestions earlier in the thread, but this is a relatively new box that hasn't been around long enough to have legacy configs. Has always been on a 2.3.x release.

    A confirmed solution would be really helpful.



  • @Veldkornet:


    The below does indeed work once off, so I need to run it every time I change the configuration.

    mkdir /var/unbound/test/
    cp -ax /var/unbound/*.{key,pem} /var/unbound/test/
    

    Is there a bug logged for it already?

    works for me.



  • This just happened to me, although my error was "/var/unbound/test/root.key" does not exist. I tried creating the test directory and copying the root.key there, but there was no change. I still couldn't save the settings for DNS Resolver.

    However, I seemed to fix it by running the command: unbound-control-setup

    I'd be interested to hear if this helped anyone else.



  • This issue is known, as the thread implies.
    But 2.3.5 is old and fading out : 32 hardware is hard to find these days - some devices are kept artificially alive, mostly in museums.
    Consider the issue as closed.



  • I am running 64 bit, 2.4.4-RELEASE-p1



  • In that case, the issue is totally new - not related to what happened as described 2 years ago - with old pfSense versions.

    Maybe some left-overs from an ancient install ?
    Did you install 2.4.4-P1 from scratch, or did you upgrade from an older version ?