DNS Resolver (unbound) / Can't change config

zimt

When I try to change any settings in unbound I get this error message, can't even disable it :

The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1550262886] unbound-checkconf[60539:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

My install worked fine for maybe two weeks, this issue just appeared. Not sure what this is related to.
I did disable pfb_dnsbl and pfb_filter but that didn't solve the issue. Also all the other tricks mentioned in this thread didn't work for me. Didn't try to reboot yet, hopefully tonight...

Here are all the services running:

Service 	Description 	
avahi 	Avahi mDNS/DNS-SD daemon 	
dhcpd 	DHCP Service 	
dpinger 	Gateway Monitoring Daemon 	
ntopng 	ntopng Network Traffic Monitor 	
ntpd 	NTP clock sync 	
openvpn 	OpenVPN server: home 	
pfb_dnsbl 	pfBlockerNG DNSBL service 	
pfb_filter 	pfBlockerNG firewall filter service 	
radvd 	Router Advertisement Daemon 	
snort 	Snort IDS/IPS Daemon 	
sshd 	Secure Shell Daemon 	
syslogd 	System Logger Daemon 	
telegraf 	Telegraf daemon 	
unbound 	DNS Resolver

johnpoz

@zimt said in DNS Resolver (unbound) / Can't change config:

I did disable pfb_dnsbl and pfb_filter

So its not a clean install, you have atleast that package installed. What else? I see avahi, ntop, snort --> So clearly its not related to a problem from 2 years ago.

I would suggest you open a thread in the pfblocker section and yell for @BBcan177 because more likely then not its related to your unbound problem.

RonpfS

Well pfblockerNG operate with the assumption that things are in /var/unbound/
Disable DNSBL then see if your mod works.

zimt

I disabled both, pfb_dnsbl and pfb_filter, that didn't help. I don't think it has anything to do with it.

RonpfS

Disabling the pfblockerng services doesn't disable DNSBL.

RonpfS

@zimt said in DNS Resolver (unbound) / Can't change config:

I don't think it has anything to do with it.

DNSBL modify unbound.conf.

zimt

rebooting resolved the issue, hope it doesn't reappear.

RonpfS

That's one way to recreate the root.key

zimt

doing it manually as indicated higher up in this thread didn't solve the problem for me.

BBcan177

@zimt said in DNS Resolver (unbound) / Can't change config:

When I try to change any settings in unbound I get this error message, can't even disable it :
The following input errors were detected:
The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1550262886] unbound-checkconf[60539:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

Try to run the following command to rebuild the missing root.key file:

unbound-anchor -a /var/unbound/root.key

apara

I am having exactly the same issue on the latest 2.4.4-RELEASE-p3 (amd64). When I go to change the DNS Resolver configuration, just pressing Save without any changes produces:

The following input errors were detected:

The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1561931530] unbound-checkconf[36495:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

For some reason, it feels that the *.pem and *.key files are not being copied from the parent directory as they definitely exist in the /var/unbound directory.

Does anyone have a solution?

RusG3G

I am also getting this error in a brand new SG5100;

The following input errors were detected:

The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/root.key: No such file or directory
[1572274588] unbound-checkconf[68733:0] fatal error: auto-trust-anchor-file: "/var/unbound/test/root.key" does not exist in chrootdir /var/unbound

I ran "unbound-anchor -a /var/unbound/root.key" rebooted and the issue is resolved

apara

@RusG3G in my case, I rebooted the firewall and all was good again... Sorry, don't have more details.

chrcoluk

Also now affected.

This seems really bizarre problem.

Some information.

The problem does "not" occur when my custom unbound configuration is included which I normally do include, but I wanted to revert to solely a auto generated config which in theory is safer but generated the error, if I include my config again, the error is gone eve though I dont configure anything related to the keys.

The 2 commands listed in the thread dont fix anything.

The keys do exist in my /var/unbound, and are dated 2017 so have been there 2 years.

The following commands enabled me to use the save function in the GUI.

cd /var/unbound
cp unbound_server.* test
cp unbound_control.* test
chflags schg /var/unbound/test/unbound_server.*
chflags schg /var/unbound/test/unbound_control.*

So basically I manually copy the keys to the test folder, I set the files to be unable to be overwritten and bam it works.

So some kind of script when hitting save is not working as it should.

I do have pfblockerng installed but I would be very surprised if thats breaking this.

bartkowski

@BBcan177 said in DNS Resolver (unbound) / Can't change config:

Try to run the following command to rebuild the missing root.key file:
unbound-anchor -a /var/unbound/root.key

This and a reboot helped me. SG-2440

Edit. 2.4.5-Release.

TheNarc

I am experiencing this issue on one of my two pfSense machines, which I'm hoping may be useful in narrowing down the cause, because they are both running 2.4.5-RELEASE on identical hardware and are configured identically to the best of my ability to tell. Both have pfBlockerNG-devel-2.2.5_32 and snort 3.2.9.11 installed. From methodically comparing all the pfBlockerNG config pages, it seems like I have it identically configured on both machines, although empirical evidence would suggest otherwise, as my pfb_dnsbl.conf is 66,992,853B on the working machine and 67,011,305B on the machine exhibiting the issue.

The only way I was able to successfully save a resolver config change (once) on the non-working machine was a variation of the steps posted by @chrcoluk. I copied all *.key and *.pem files in /var/unbound/ to /var/unbound/test/ and then made them immutable with chflags schg.

I'm happy to provide further information, conf files, screen shots of settings, etc. if anyone has theories they'd like to investigate. But having no theories of my own I don't want to immediately dump a bunch of unsolicited data here.

I should also note that both of these machines have been installed for years and been through multiple upgrade cycles, so I fully understand if no one wants to investigate something that would almost definitely be solved by a fresh installation and config restore. I'm not asking for help, just offering a source of potentially useful data in case anyone is so inclined . . .

bartkowski

@bartkowski said in DNS Resolver (unbound) / Can't change config:

This and a reboot helped me. SG-2440
Edit. 2.4.5-Release.

It happened to me again today. Only way I could fix it is reboot.
I do have a very large (over 800K) DNSBL list in pfBlockerNG-devel (latest).

OffstageRoller

I also had this happen today as well. A reboot cleared things up for me.

2.4.5_1 with a number of packages installed, including pfBlockerNG-devel 2.2.5_33. In all my years running pfSense with this package, this is the first time I've run into this error message.

luckman212

I've had this bug pop up from time to time as well. I saw a recent redmine that seems very closely related:
https://redmine.pfsense.org/issues/10781

Looks like a PR is already made and might solve this for good in 2.5 snaps.

chrisgtl

@luckman212 said in DNS Resolver (unbound) / Can't change config:

I've had this bug pop up from time to time as well. I saw a recent redmine that seems very closely related:
https://redmine.pfsense.org/issues/10781

Looks like a PR is already made and might solve this for good in 2.5 snaps.

You sir I owe a beer or two to! Top man!! This solved it for me.....