#5434 DNS Cluster Slave Server: Zone Transfer fail on slave (only) the first time

[Daniel Rosenow]

I have 2 Webmin Servers running on Ubuntu 18.04 and 20.04. I added the second server as a Cluster Slave Servers.

If I create a new master zone, the zone is also configured on the slave... but the initial zone transfer fails.

Error message on View Records File @slave-server:

This page shows the DNS records file /var/lib/bind/test3.de.hosts, created by BIND when the zone was transferred from the master server.
However the file is currently empty, probably because the zone has not yet been transferred from the master server.

If I manually trigger a zone transfer with rndc retransfer <zonename>, everything works. A second workarround is to change the zone file on the master to trigger a zone transfer... but this workarounds should be avoided.

Can someone reproduce the issue? Perhaps the initial zone transfer is not working, because the transfer is triggered during the creation of the zone on slave side is still ongoing?

[Jamie Cameron]

Does anything get logged to /var/log/messages on the master or slave systems indicating why the initial transfer might have failed?

[Daniel Rosenow]

I don't know , why I have a "end of file" and "permission denied". But could it happen, that the master is creating the slave dns and parallel sending the notify to the slave... so that on slave side the zone file can't be changed by 2 processes at the same time?

This logs are triggered, after I created a virtual server in virtualmin with feature "DNS Domain enabled".

Master:

Dec 19 10:05:09 amd1 named[970]: reloading configuration succeeded
Dec 19 10:05:09 amd1 named[970]: reloading zones succeeded
Dec 19 10:05:09 amd1 named[970]: zone testbindsync.de/IN: loaded serial 2020121900
Dec 19 10:05:09 amd1 named[970]: zone testbindsync.de/IN: sending notifies (serial 2020121900)
Dec 19 10:05:09 amd1 named[970]: all zones loaded
Dec 19 10:05:09 amd1 named[970]: running
Dec 19 10:05:09 amd1 named[970]: managed-keys-zone: Key 20326 for zone . acceptance timer complete: key now trusted
Dec 19 10:05:09 amd1 named[970]: client @0x7fa8a012c7b0 YYY.YYY.YYY.YYY#44905 (testbindsync.de): transfer of 'testbindsync.de/IN': AXFR started (serial 2020121900)
Dec 19 10:05:09 amd1 named[970]: client @0x7fa8a012c7b0 YYY.YYY.YYY.YYY#44905 (testbindsync.de): transfer of 'testbindsync.de/IN': AXFR ended

Slave:

Dec 19 10:05:09 amd2 named[892]: reloading configuration succeeded
Dec 19 10:05:09 amd2 named[892]: client @0x7f55b401beb0 xxx.xxx.xxx.xxx#56799: received notify for zone 'testbindsync.de'
Dec 19 10:05:09 amd2 named[892]: zone testbindsync.de/IN: notify from XXX.XXX.XXX.XXX#56799: no serial
Dec 19 10:05:09 amd2 named[892]: reloading zones succeeded
Dec 19 10:05:09 amd2 named[892]: master.c:2251: unexpected error:
Dec 19 10:05:09 amd2 named[892]: isc_stdio_read failed: end of file
Dec 19 10:05:09 amd2 named[892]: zone testbindsync.de/IN: loading from master file /var/lib/bind/testbindsync.de.hosts failed: end of file
Dec 19 10:05:09 amd2 named[892]: zone testbindsync.de/IN: Transfer started.
Dec 19 10:05:09 amd2 named[892]: all zones loaded
Dec 19 10:05:09 amd2 named[892]: running
Dec 19 10:05:09 amd2 named[892]: transfer of 'testbindsync.de/IN' from XXX.XXX.XXX.XXX#53: connected using 93.104.214.4#44905
Dec 19 10:05:09 amd2 named[892]: zone testbindsync.de/IN: transferred serial 2020121900
Dec 19 10:05:09 amd2 named[892]: zone testbindsync.de/IN: transfer: could not set file modification time of '/var/lib/bind/testbindsync.de.hosts': permission denied
Dec 19 10:05:09 amd2 named[892]: transfer of 'testbindsync.de/IN' from xxx.xxx.xxx.xxx#53: Transfer status: success
Dec 19 10:05:09 amd2 named[892]: transfer of 'testbindsync.de/IN' from xxx.xxx.xxx.xxx#53: Transfer completed: 1 messages, 8 records, 347 bytes, 0.016 secs (21687 bytes/sec)
Dec 19 10:05:09 amd2 named[892]: zone testbindsync.de/IN: sending notifies (serial 2020121900)
Dec 19 10:05:09 amd2 named[892]: managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)

[Jamie Cameron]

Permissions may be the issue here. What output do you get if you run ls -l /var/lib/bind/testbindsync.de.hosts ?

[Daniel Rosenow]

On the master server this file is owned by root:bind and on the slave by bind:bind. (644)

But the strange thing is, that everything works the second time... this problem happens only on the first transfer. ch