src.conf ignored; phantom named

[Gary Palmer]

On Fri, Mar 02, 2012 at 06:48:12PM -0500, Rotate 13 wrote:
> > As for named running, if you do
> >
> > sh /etc/rc.d/named restart
> >
> > does it succeed?  If so, the 'named_enable="no"' flag must be set wrong.
> 
> "sh /etc/rc.d/named restart" gives exactly what you would expect
> ("Cannot `restart` named. Set named_enable to YES...").
> 
> > Also check to make sure that its not named from ports or some other
> > location (e.g. check fstat or lsof or something to make sure its actually
> > /usr/sbin/named and not from some other location)
> 
> "fstat | grep /named" returns nothing (!), likewise "fstat | grep
> /sbin".

fstat only shows the inode number of the file, e.g. 

fstat -p 1283 | egrep '(^USER|text)'
USER     CMD          PID   FD MOUNT      INUM MODE         SZ|DV R/W
bind     named       1283 text /usr     333873 -r-xr-xr-x  1659284  r
% ls -i /usr/sbin/named
333873 /usr/sbin/named

> However:
> 
> # procstat -b `pgrep named`
>   PID COMM             PATH
> 63121 named            /usr/sbin/named
> 63090 named            /usr/sbin/named
> 
> (I also never used ports BIND.)
> 
> I would really like to figure this out before I do the necessary work
> to remove unwanted BIND from the system.  Processes running without
> apparent reason, indicates something else is wrong.
> 
> Thanks for the help so far.  I am continuing to poke the system, just
> looking for the right tool to find out how this got started (also
> grepping logs which show start but don't seem to show why).

I don't recall seeing in your original message - after the installworld,
did you reboot? Does "ps auxww | grep named" show that the process
predates your installworld? (The 9th column should show when the process
started, from memory)

If the named rc.d file shows that the flag is set correctly to disable
named I'm not sure what else would start it.  

I'm also curious as to why two instances of named appear to be running.
On the face of it that would appear to be broken as only one could bind
to port 53.  You're not running jails or anything similar are you?

Gary