Alibaba Cloud Linux:What do I do if the "Job for unbound.service failed because a timeout was exceeded" error message appears when the Unbound service is started on an ECS instance that runs Alibaba Cloud Linux 3?

Problem description

The Unbound service fails to be started after the unbound-1.7.3 or unbound-1.16.2 package is installed on an ECS instance that runs the Alibaba Cloud Linux 3 operating system.

The following error message is returned:

# sudo systemctl start unbound
Job for unbound.service failed because a timeout was exceeded.
See "systemctl status unbound.service" and "journalctl -xe" for details.

Cause

The ExecStartPre directive is changed in the unbound-1.7.3 and unbound-1.16.2 versions of the Unbound service. The DISABLE_UNBOUND_ANCHOR variable is added to specify whether to run the unbound-anchor command. In this command, the -f /etc/resolv.conf -R parameter can be used to specify or update the root trust anchor on the root server for Domain Name System Security Extensions (DNSSEC) validation. In an environment without Internet connectivity, access to the root server is denied after the unbound-anchor command is run. As a result, the instance fails to query the root trust anchor and start the Unbound service.

Solution

In an environment without Internet connectivity, set the DISABLE_UNBOUND_ANCHOR environment variable to yes to disable the unbound-anchor command from being run. This prevents access to the root server and ensures that the Unbound service can be started as expected.

1. Open the /etc/sysconfig/unbound file.

   sudo vim /etc/sysconfig/unbound

2. Press the I key to enter Insert mode and add the following content to the file:

   DISABLE_UNBOUND_ANCHOR=yes

3. Press the Esc key, enter :wq, and then press the Enter key to save and close the configuration file.

4. Start the Unbound service.

   sudo systemctl start unbound

References

For more information about the unbound-anchor command, see Unbound.