Hi,
We are testing migration from bind to knot, to implement dnssec. We like
many things about knot! Thank you for making it available!
So far many things work, but we do have some uncertainties. Hope they're
not too basic to ask here...
We are using ubuntu, knot 3.1.0, our static bind zone files saved as
/var/lib/knot/zones/db.domain.com and also the non-binary knot config.
(in /etc/knot/knot.conf)
1) I wanted to test the knotc zone-backup command, but we're getting:
> error: backup init failed (operation not permitted)
Is the zone-backup command geared towards binary zones? Are our static
zone files the reason this doesn't work? I realise we can simply copy
the zone files, so in our case, the backup command probably adds nothing.
2) I have enabled DNSSEC, and upon restart we saw the keys being
generated, and files appeared under /var/lib/knot/keys
I guess keeping copies of the files there is adequate backup too? No
"knotc zone-backup" required here as well?
3) After each knot restart, we are seeing:
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: info: [1.2.3.4.in-addr.arpa.] DNSSEC, zone is up-to-date
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: info: [1.2.3.4.in-addr.arpa.] loaded, serial none -> 2017041004, 106139 bytes
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: info: [1.2.3.4.in-addr.arpa.] DNSSEC, next signing at 2021-08-09T16:10:10+0200
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: info: [domain.com.] DNSSEC, zone is up-to-date
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: info: [domain.com.] loaded, serial none -> 2021072903, 183151 bytes
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: info: [domain.com.] DNSSEC, next signing at 2021-08-09T16:10:10+0200
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: warning: [domain.com.] failed to update zone file (operation not permitted)
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: error: [domain.com.] zone event 'journal flush' failed (operation not permitted)
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: warning: [1.2.3.4.in-addr.arpa.] failed to update zone file (operation not permitted)
> Aug 2 16:44:56 Latitude-E7470 knotd[259063]: error: [1.2.3.4.in-addr.arpa.] zone event 'journal flush' failed (operation not permitted)
We would like to understand the warnings/errors here too. Why would knot
try to update the zone files, and why it is failing? I have set the
permissions on the zone files 660 / knot:knot so it should be able edit
them. (but again: why would knot want to update them?)
Thanks for any feedback!
MJ
Hi all
I am currently running these two policies:
```
policy:
- id: edecc
algorithm: ed25519
nsec3: on
- id: rsa
algorithm: RSASHA256
ksk-size: 2048
zsk-size: 2048
nsec3: on
```
I tried enabling both with this command, but to no effect:
```
dnssec-policy: [ edecc, rsa ]
```
Is there a way to do both at the same time in one zone?
I am currently running knot 3.0.8
Cheers,
Stefan
