auth faq: document a ProtectSystem=full implication

diff --git a/docs/appendices/FAQ.rst b/docs/appendices/FAQ.rst
index a7a0ac2e5cc0b45a32f1664f39bedbc298fd0115..da10d965ceac7fd117c0fbf66086772279135584 100644 (file)
--- a/docs/appendices/FAQ.rst
+++ b/docs/appendices/FAQ.rst
@@ -72,6 +72,13 @@ Linux Netfilter says your conntrack table is full?
 Thats a common problem with Netfilter Conntracking and DNS Servers, just tune your kernel variable (``/etc/sysctl.conf``) ``net.ipv4.netfilter.ip_conntrack_max`` up accordingly.
 Try setting it for a million if you don't mind spending some MB of RAM on it for example.
 
+I get an error about writing to /etc
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+This may look something like "unable to open temporary zonefile '/etc/powerdns/zones/example.com.<random number>'".
+Our systemd units enable ``ProtectSystem=full`` by default, which disallows writes to ``/etc`` and ``/usr``, among other places.
+Either move your zone files to a safer place (``/var/lib/powerdns`` is a popular choice) or change the systemd protection settings.
+
 Backends
 --------