{"id":2161,"date":"2017-10-05T18:10:21","date_gmt":"2017-10-05T12:40:21","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=2161"},"modified":"2026-09-15T16:14:14","modified_gmt":"2026-09-15T10:44:14","slug":"vestacp-bind-loading-master-file-failed-permission-denied","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/vestacp-bind-loading-master-file-failed-permission-denied\/","title":{"rendered":"VestaCP &#8211; bind &#8211; loading from master file failed: permission denied"},"content":{"rendered":"\n<h2 class=\"wp-block-heading topic-title\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Managing DNS zones through VestaCP is usually straightforward, but sometimes Bind9 may fail to load zone files even when file permissions appear to be configured correctly. One of the most common errors administrators encounter is:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">zone example.com\/IN: loading from master file \/home\/admin\/conf\/dns\/example.com.db failed: permission denied<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">At first glance, this looks like a standard Linux file permission issue. However, in many cases, the actual cause is AppArmor security restrictions preventing Bind from accessing DNS zone files stored in VestaCP&#8217;s custom directory structure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this guide, you&#8217;ll learn how to identify the root cause, verify file permissions, check AppArmor restrictions, and permanently resolve the Bind9 &#8220;permission denied&#8221; error on Ubuntu servers running VestaCP.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Error Overview<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When restarting or reloading Bind9, you may see an error similar to:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">zone example.com\/IN: loading from master file \/home\/admin\/conf\/dns\/example.com.db failed: permission denied<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This prevents Bind from loading the DNS zone, causing DNS records for the affected domain to stop resolving correctly.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Root Cause<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The issue is typically caused by one of the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Incorrect file ownership on the DNS zone file.<\/li>\n\n\n\n<li>Insufficient read permissions for the Bind service.<\/li>\n\n\n\n<li>AppArmor preventing Bind from accessing files outside its default directories.<\/li>\n\n\n\n<li>Corrupted or inaccessible zone files.<\/li>\n\n\n\n<li>Incorrect Bind configuration.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In VestaCP environments, the most common cause is AppArmor blocking access to zone files stored under:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/home\/admin\/conf\/dns\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Because Bind&#8217;s default AppArmor profile only allows access to specific directories such as:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/bind\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">the service cannot read VestaCP-managed DNS zone files unless the profile is updated.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting Flow<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/10\/bind9_reload_troubleshooting_flowchart-scaled.png\"><img fetchpriority=\"high\" decoding=\"async\" width=\"652\" height=\"1024\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/10\/bind9_reload_troubleshooting_flowchart-652x1024.png\" alt=\"\" class=\"wp-image-11784\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/10\/bind9_reload_troubleshooting_flowchart-652x1024.png 652w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/10\/bind9_reload_troubleshooting_flowchart-191x300.png 191w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/10\/bind9_reload_troubleshooting_flowchart-768x1206.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/10\/bind9_reload_troubleshooting_flowchart-978x1536.png 978w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/10\/bind9_reload_troubleshooting_flowchart-1304x2048.png 1304w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/10\/bind9_reload_troubleshooting_flowchart-scaled.png 1630w\" sizes=\"(max-width: 652px) 100vw, 652px\" \/><\/a><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Verify File Permissions<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ls -lah \/home\/admin\/conf\/dns\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">-rw-r----- 1 root bind 645 Nov 28 13:09 example.com.db<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Correct if necessary:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">chown root:bind \/home\/admin\/conf\/dns\/example.com.db\nchmod 640 \/home\/admin\/conf\/dns\/example.com.db<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Confirm Bind Is Running<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ps aux | grep named<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">bind     16679  0.0  0.3 238688 13692 ? Ssl 13:18 0:00 \/usr\/sbin\/named -u bind<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Check AppArmor Denials<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -xe | grep apparmor<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">dmesg | grep DENIED<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">apparmor=\"DENIED\" operation=\"open\"\nprofile=\"\/usr\/sbin\/named\"\nname=\"\/home\/admin\/conf\/dns\/example.com.db\"<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Update AppArmor Profile<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Edit:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">nano \/etc\/apparmor.d\/usr.sbin.named<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Find:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/bind\/** rw,<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/home\/** rwm,<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Save and exit.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Restart Services<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">systemctl restart apparmor\nsystemctl restart bind9<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Validate Configuration<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">named-checkconf<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Validate the zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">named-checkzone example.com \/home\/admin\/conf\/dns\/example.com.db<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reload DNS:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">rndc reload<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Bind9 &#8220;loading from master file failed: permission denied&#8221; error in VestaCP environments is often misleading because file permissions may appear perfectly valid. In most cases, AppArmor is blocking access to DNS zone files stored under VestaCP&#8217;s custom DNS directory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By verifying file ownership, checking AppArmor logs, updating the Bind AppArmor profile, and restarting the required services, you can quickly restore DNS functionality and prevent future zone loading failures.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Following the troubleshooting steps outlined in this guide will help ensure your Bind9 server can successfully access and load all VestaCP-managed DNS zones.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions (FAQ)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Why does Bind show &#8220;permission denied&#8221; even when the file permissions are correct?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This usually happens because AppArmor is restricting Bind&#8217;s access to the zone file. Linux file permissions may be correct, but AppArmor can still block access based on its security policy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. How can I verify whether AppArmor is causing the issue?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">journalctl -xe | grep apparmor<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">dmesg | grep DENIED<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you see AppArmor DENIED messages referencing the zone file, AppArmor is the cause.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Is it safe to allow Bind access to <code>\/home\/admin\/conf\/dns\/<\/code>?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. VestaCP stores DNS zone files in this location. Updating the AppArmor profile to allow Bind access to the required directory is a standard and safe solution when properly configured.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related Articles<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/pheonixsolutions.com\/blog\/add-webmail-alias-vestacp-panel-ubuntu-16-04\/\">Add Webmail Alias in VestaCP Panel on Ubuntu 16.04<\/a><\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/pheonixsolutions.com\/blog\/laravel-installation-vestacp-account\/\">Laravel Installation on a VestaCP Account<\/a><\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-to-force-webmail-to-use-ssl-in-vestacp\/\">How to Force Webmail to Use SSL in VestaCP<\/a><\/strong><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Talk to our experts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team&nbsp;<a href=\"https:\/\/pheonixsolutions.com\/contact\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Managing DNS zones through VestaCP is usually straightforward, but sometimes Bind9 may fail to load zone files even when [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1019],"tags":[392,391],"class_list":["post-2161","post","type-post","status-publish","format-standard","hentry","category-cloud-aws","tag-bind9","tag-vesta","psol-cat-cloud-aws"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-yR","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2161","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=2161"}],"version-history":[{"count":1,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2161\/revisions"}],"predecessor-version":[{"id":11785,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2161\/revisions\/11785"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=2161"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=2161"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=2161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}