These debian issues seem very related:
Hmm, named failing at start on one of the secondaries: need to investigate this further
Posted by jpluimers on 2017/05/24
I was not too happy that this just happened after updating one of the DNS secondaries:
May 24 21:29:48 laurel systemd[1]: Starting LSB: Domain Name System (DNS) server, named... -- Subject: Unit named.service has begun start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit named.service has begun starting up. May 24 21:29:49 laurel named[3173]: Starting name server BIND cp: cannot stat '/lib/engines': No such file or directory May 24 21:29:51 laurel named[3235]: starting BIND 9.10.4-P5 -t /var/lib/named -u named May 24 21:29:51 laurel named[3235]: running on Linux armv6l 4.3.3-6-raspberrypi #1 Wed Dec 16 08:03:35 UTC 2015 (db72752) May 24 21:29:51 laurel named[3235]: built with '--prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--localstatedir=/var' '--libdir=/usr/lib' '--enable-exportlib' '--with-export-libdir=/usr/lib' '--with-export-includedir=/usr/i May 24 21:29:51 laurel named[3235]: ---------------------------------------------------- May 24 21:29:51 laurel named[3235]: BIND 9 is maintained by Internet Systems Consortium, May 24 21:29:51 laurel named[3235]: Inc. (ISC), a non-profit 501(c)(3) public-benefit May 24 21:29:51 laurel named[3235]: corporation. Support and training for BIND 9 are May 24 21:29:51 laurel named[3235]: available at https://www.isc.org/support May 24 21:29:51 laurel named[3235]: ---------------------------------------------------- May 24 21:29:51 laurel named[3235]: adjusted limit on open files from 4096 to 1048576 May 24 21:29:51 laurel named[3235]: found 1 CPU, using 1 worker thread May 24 21:29:51 laurel named[3235]: using 1 UDP listener per interface May 24 21:29:51 laurel named[3235]: using up to 4096 sockets May 24 21:29:51 laurel named[3235]: ENGINE_by_id failed (crypto failure) May 24 21:29:51 laurel named[3235]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:233: May 24 21:29:51 laurel named[3235]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:467: May 24 21:29:51 laurel named[3235]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:390:id=gost May 24 21:29:51 laurel named[3235]: initializing DST: crypto failure May 24 21:29:51 laurel named[3235]: exiting (due to fatal error) May 24 21:29:51 laurel named[3173]: ..failed May 24 21:29:51 laurel systemd[1]: named.service: Control process exited, code=exited status=1 May 24 21:29:51 laurel systemd[1]: Failed to start LSB: Domain Name System (DNS) server, named. -- Subject: Unit named.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit named.service has failed. -- -- The result is failed. May 24 21:29:51 laurel systemd[1]: named.service: Unit entered failed state. May 24 21:29:51 laurel systemd[1]: named.service: Failed with result 'exit-code'.
It’s in fact a manifestation of [Archive.is] Bug 1040027 – bind (named): fails to start since the introduction of namespaced openSSL packages
A fix is in the pipeline at [Archice.is] Request 496968 – openSUSE Build Service
However, that fix never made it to Raspberry Pi B (the original Rasberry Pi 1B) because that is armv6l
and the bind
build for that has failed early April 2017.
- https://build.opensuse.org/package/live_build_log/openSUSE:Factory:ARM/bind/standard/armv6l
- https://build.opensuse.org/packages/bind/job_history/openSUSE:Factory:ARM/standard/armv6l
That’s now in [Archive.is] Bug 1040697 – bind fails building for armv6l since 20170401 causing bugfixes not to make it to the wild.
–jeroen
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bind fails building for armv6l: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:ARM/bind/standard/armv6l | |
This has been failing since 20170401: https://build.opensuse.org/packages/bind/job_history/openSUSE:Factory:ARM/standard/armv6l | |
The effect is that the fix https://bugzilla.suse.com/show_bug.cgi?id=1040027 isn't incorporated CPE_NAME="cpe:/o:opensuse:tumbleweed:20170521" hence the same severity as #1040027 | |
I've reproduced this on a Raspberry Pi B (Raspberry Pi 1 Model B+ revision 1.2): | |
# arch | |
armv6l | |
# grep CPE_NAME /etc/os-release | |
CPE_NAME="cpe:/o:opensuse:tumbleweed:20170521" | |
# rpm -q –changelog bind | head | |
* Sat Feb 18 2017 kukuk@suse.com | |
– Don't require and call insserv if we use systemd | |
* Wed Feb 15 2017 navin.kukreja@suse.com | |
– Fix assertion failure or a NULL pointer read for configurations using both DNS64 and RPZ | |
* CVE-2017-3135, bsc#1024130 | |
* bind-CVE-2017-3135.patch | |
* Thu Jan 12 2017 sflees@suse.de | |
– Update to latest release in the 9.10.X series | |
# rpm -q –qf "%{disturl}\n" bind | |
obs://build.opensuse.org/openSUSE:Factory:ARM/standard/6bd0d5a239350474428974a83bd59787-bind | |
# rpm -q bind | |
bind-9.10.4P5-24.1.armv6hl |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
May 24 21:29:48 laurel systemd[1]: Starting LSB: Domain Name System (DNS) server, named… | |
— Subject: Unit named.service has begun start-up | |
— Defined-By: systemd | |
— Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel | |
— | |
— Unit named.service has begun starting up. | |
May 24 21:29:49 laurel named[3173]: Starting name server BIND cp: cannot stat '/lib/engines': No such file or directory | |
May 24 21:29:51 laurel named[3235]: starting BIND 9.10.4-P5 -t /var/lib/named -u named | |
May 24 21:29:51 laurel named[3235]: running on Linux armv6l 4.3.3-6-raspberrypi #1 Wed Dec 16 08:03:35 UTC 2015 (db72752) | |
May 24 21:29:51 laurel named[3235]: built with '–prefix=/usr' '–bindir=/usr/bin' '–sbindir=/usr/sbin' '–sysconfdir=/etc' '–localstatedir=/var' '–libdir=/usr/lib' '–enable-exportlib' '–with-export-libdir=/usr/lib' '–with-export-includedir=/usr/i | |
May 24 21:29:51 laurel named[3235]: —————————————————- | |
May 24 21:29:51 laurel named[3235]: BIND 9 is maintained by Internet Systems Consortium, | |
May 24 21:29:51 laurel named[3235]: Inc. (ISC), a non-profit 501(c)(3) public-benefit | |
May 24 21:29:51 laurel named[3235]: corporation. Support and training for BIND 9 are | |
May 24 21:29:51 laurel named[3235]: available at https://www.isc.org/support | |
May 24 21:29:51 laurel named[3235]: —————————————————- | |
May 24 21:29:51 laurel named[3235]: adjusted limit on open files from 4096 to 1048576 | |
May 24 21:29:51 laurel named[3235]: found 1 CPU, using 1 worker thread | |
May 24 21:29:51 laurel named[3235]: using 1 UDP listener per interface | |
May 24 21:29:51 laurel named[3235]: using up to 4096 sockets | |
May 24 21:29:51 laurel named[3235]: ENGINE_by_id failed (crypto failure) | |
May 24 21:29:51 laurel named[3235]: error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:233: | |
May 24 21:29:51 laurel named[3235]: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:467: | |
May 24 21:29:51 laurel named[3235]: error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:390:id=gost | |
May 24 21:29:51 laurel named[3235]: initializing DST: crypto failure | |
May 24 21:29:51 laurel named[3235]: exiting (due to fatal error) | |
May 24 21:29:51 laurel named[3173]: ..failed | |
May 24 21:29:51 laurel systemd[1]: named.service: Control process exited, code=exited status=1 | |
May 24 21:29:51 laurel systemd[1]: Failed to start LSB: Domain Name System (DNS) server, named. | |
— Subject: Unit named.service has failed | |
— Defined-By: systemd | |
— Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel | |
— | |
— Unit named.service has failed. | |
— | |
— The result is failed. | |
May 24 21:29:51 laurel systemd[1]: named.service: Unit entered failed state. | |
May 24 21:29:51 laurel systemd[1]: named.service: Failed with result 'exit-code'. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ARM: | |
# grep CPE_NAME /etc/os-release | |
CPE_NAME="cpe:/o:opensuse:tumbleweed:20170521" | |
# rpm -q –changelog bind | head | |
* Sat Feb 18 2017 kukuk@suse.com | |
– Don't require and call insserv if we use systemd | |
* Wed Feb 15 2017 navin.kukreja@suse.com | |
– Fix assertion failure or a NULL pointer read for configurations using both DNS64 and RPZ | |
* CVE-2017-3135, bsc#1024130 | |
* bind-CVE-2017-3135.patch | |
* Thu Jan 12 2017 sflees@suse.de | |
– Update to latest release in the 9.10.X series | |
x64: | |
# grep CPE_NAME /etc/os-release | |
CPE_NAME="cpe:/o:opensuse:tumbleweed:20170522" | |
# rpm -q –changelog bind | head | |
* Sat May 20 2017 dimstar@opensuse.org | |
a- Fix named init script to dynamically find the location of the | |
openssl engines (boo#1040027). | |
* Mon Mar 20 2017 kukuk@suse.de | |
– Add with_systemd define with default off, since we still use init | |
scripts and no systemd units. | |
* Sat Feb 18 2017 kukuk@suse.com | |
– Don't require and call insserv if we use systemd |
Leave a Reply