Re: logs

--===============6192215413538071560==
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="xo44VMWPx7vlQ2+2"
Content-Disposition: inline


--xo44VMWPx7vlQ2+2
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hello,
** Jos=E9 Luis Artuch <[email protected]> [2019-10-24 10:38:43 -0300=
]:

> Thanks Simon,
>=20
> Exactly, there was the problem !!
> I just discovered it at the same time you wrote with the data provided
> by Andreas and Jeroen :)
>=20
> Thank you very much to all three for guiding me !!!
>=20
> Here what I did:
>=20
> mkdir -p /var/log/nsd
> chown nsd:nsd /var/log/nsd
>=20
> nano /etc/nsd/nsd.conf
> ...
> logfile: "/var/log/nsd/nsd.log"
> ...
>=20
> cp /lib/systemd/system/nsd.service{,_original}
> nano /lib/systemd/system/nsd.service
> ...
> ReadWritePaths=3D/var/lib/nsd /etc/nsd /run /var/log/nsd
> ...

And you didn't follow good advice:=20

$ sudo systemctl edit nsd

Next NSD upgrade will overwrite your changes and you will again come to
ML and will again ask the same question. Don't invent the wheel and
NEVER touch system configuration file IF there is altenative.

> systemctl daemon-reload		<---	!!!!
> systemctl restart nsd
>=20
> Thank you very much again, best regards !!
> Jos=E9 Luis
>=20
> El jue, 24-10-2019 a las 08:58 -0400, Simon Deziel escribi=F3:
>> On 2019-10-24 8:46 a.m., Jos=E9 Luis Artuch wrote:
>>> Thanks Jeroen,
>>>=20
>>> About permissions and owners:
>>> For /var/log/nsd.log, the directory /var/log/ has 755 root:root
>>> For /var/log/nsd/nsd.log, I created alternatively a directory
>>> /var/log/nsd/ with permissions 664, 666 and 777, for both nsd and
>>> root
>>> owners.
>>> As for NSD user, in /etc/nsd/nsd.conf I have configured username:
>>> nsd.
>>>=20
>>> cat /lib/systemd/system/nsd.service
>>> [Unit]
>>> Description=3DName Server Daemon
>>> Documentation=3Dman:nsd(8)
>>> After=3Dnetwork.target
>>>=20
>>> [Service]
>>> Type=3Dnotify
>>> Restart=3Dalways
>>> ExecStart=3D/usr/sbin/nsd -d
>>> ExecReload=3D+/bin/kill -HUP $MAINPID
>>> CapabilityBoundingSet=3DCAP_CHOWN CAP_IPC_LOCK CAP_NET_BIND_SERVICE
>>> CAP_SETGID CAP_SETUID CAP_SYS_CHROOT
>>> MemoryDenyWriteExecute=3Dtrue
>>> NoNewPrivileges=3Dtrue
>>> PrivateDevices=3Dtrue
>>> PrivateTmp=3Dtrue
>>> ProtectHome=3Dtrue
>>> ProtectControlGroups=3Dtrue
>>> ProtectKernelModules=3Dtrue
>>> ProtectKernelTunables=3Dtrue
>>> ProtectSystem=3Dstrict
>>> ReadWritePaths=3D/var/lib/nsd /etc/nsd /run
>>=20
>> ProtectSystem=3Dstrict turns most of the hierarchy into read only
>> mounts
>> so you need to add /var/log and/or /var/log/nsd as ReadWritePaths=3D
>> for
>> them to be writable by nsd itself. This is normally not needed as
>> logging goes through syslog by default but you are likely using
>> "logfile" in nsd.conf.
>>=20
>> To add that ReadWritePaths directive:
>>=20
>>   sudo systemctl edit nsd
>>=20
>> Then type and save the following:
>>=20
>> [Service]
>> ReadWritePaths=3D/var/log/nsd
>>=20
>>=20
>> This will create an override file supplementing the package provided
>> unit with your local config.
>>=20
>> HTH,
>> Simon

---
WBR, Vladimir Lomov

--=20
Remember that there is an outside world to see and enjoy.
		-- Hans Liepmann

--xo44VMWPx7vlQ2+2
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQQaopaKwcQWyz7yQfAHGfInzJc4BQUCXbGsagAKCRAHGfInzJc4
BbE4AP4jhLJ3WtxdXNY/ybNMF7ccZwMd+Ob6VzWviHadUmJxtQEAjtQC2WdgAyZv
Hd0bOdkebNGjJVKIvR+K6U4B8d+GqQI=
=YQJJ
-----END PGP SIGNATURE-----

--xo44VMWPx7vlQ2+2--

--===============6192215413538071560==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
nsd-users mailing list
[email protected]
https://open.nlnetlabs.nl/mailman/listinfo/nsd-users

--===============6192215413538071560==--