{"record":{"id":"ee77631c66476b90","repo":"TechnitiumSoftware/DnsServer","slug":"failed-to-read-zones-permissions-auth-config-fi","errorCode":null,"errorMessage":"Failed to read 'Zones' permissions: auth.config file is probably corrupt.","messagePattern":"Failed to read 'Zones' permissions: auth\\.config file is probably corrupt\\.","errorType":"exception","errorClass":"DnsWebServiceException","httpStatus":null,"severity":"critical","filePath":"DnsServerCore/DnsWebService.cs","lineNumber":439,"sourceCode":"        }\n\n        public void SaveConfigFile()\n        {\n            lock (_saveLock)\n            {\n                if (_pendingSave)\n                    return;\n\n                _pendingSave = true;\n                _saveTimer.Change(SAVE_TIMER_INITIAL_INTERVAL, Timeout.Infinite);\n            }\n        }\n\n        private void InspectAndFixZonePermissions()\n        {\n            Permission permission = _authManager.GetPermission(PermissionSection.Zones);\n            if (permission is null)\n                throw new DnsWebServiceException(\"Failed to read 'Zones' permissions: auth.config file is probably corrupt.\");\n\n            IReadOnlyDictionary<string, Permission> subItemPermissions = permission.SubItemPermissions;\n\n            //remove ghost permissions\n            foreach (KeyValuePair<string, Permission> subItemPermission in subItemPermissions)\n            {\n                string zoneName = subItemPermission.Key;\n\n                if (_dnsServer.AuthZoneManager.GetAuthZoneInfo(zoneName) is null)\n                    permission.RemoveAllSubItemPermissions(zoneName); //no such zone exists; remove permissions\n            }\n\n            //add missing admin permissions\n            IReadOnlyList<AuthZoneInfo> zones = _dnsServer.AuthZoneManager.GetAllZones();\n            Group admins = _authManager.GetGroup(Group.ADMINISTRATORS);\n            if (admins is null)\n                throw new DnsWebServiceException(\"Failed to find 'Administrators' group: auth.config file is probably corrupt.\");\n","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/DnsWebService.cs#L421-L457","documentation":"Thrown by DnsWebService.InspectAndFixZonePermissions when _authManager.GetPermission(PermissionSection.Zones) returns null, meaning the Zones permission block is absent from auth.config. This routine reconciles per-zone permissions against existing zones and runs during startup/save; a missing top-level Zones section is treated as corruption because the server cannot reason about zone access without it.","triggerScenarios":"Server startup or config-save path that calls InspectAndFixZonePermissions while auth.config has no Zones permission section. Triggered after a manual edit, partial restore, or migration that dropped the section.","commonSituations":"Restoring an auth.config from an older incompatible version; hand-editing auth.config and removing the Zones block; filesystem corruption or truncated write; migrating between Technitium major versions without the config upgrade path.","solutions":["Restore auth.config from a known-good backup.","Recreate the Zones permission section via the Web Service settings UI/API so GetPermission(PermissionSection.Zones) is non-null.","Delete auth.config and let the server regenerate defaults on next start, then reconfigure users/groups.","Check disk free space / permissions so the config file is not silently truncated on save."],"exampleFix":"// before\nPermission permission = _authManager.GetPermission(PermissionSection.Zones);\nif (permission is null)\n    throw new DnsWebServiceException(\"Failed to read 'Zones' permissions: auth.config file is probably corrupt.\");\n\n// after (call site guard)\nPermission permission = _authManager.GetPermission(PermissionSection.Zones);\nif (permission is null)\n    permission = _authManager.CreatePermissionSection(PermissionSection.Zones); // repair instead of throw","handlingStrategy":"try-catch","validationCode":"// Before triggering permissions reconciliation, confirm the section exists\nif (_authManager.GetPermission(PermissionSection.Zones) is null)\n{\n    // repair or restore auth.config before continuing\n}","typeGuard":"null","tryCatchPattern":"try\n{\n    _dnsWebService.Start(); // or the routine that triggers InspectAndFixZonePermissions\n}\ncatch (DnsWebServiceException ex) when (ex.Message.Contains(\"'Zones' permissions\"))\n{\n    // restore auth.config from backup, then restart\n    logger.LogError(\"auth.config missing Zones section: {Msg}\", ex.Message);\n}","preventionTips":["Keep versioned backups of auth.config before any user/permission change.","Never hand-edit auth.config while the service is running.","After any restore, validate built-in sections exist before restarting the service."],"tags":["dns-server","technitium","auth","configuration","config-corruption","permissions","csharp"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}