28 Dub
2017
28 Dub
'17
10:17
Hi Volker,
thank you for your interest in Knot DNS.
When automatic policy is used (manual: off), both KSK and ZSK are
generated at the beginning, and ZSK rollover (pre-publish method) is
automatically performed when needed (default for zsk-lifetime is 30
days). Automatic KSK rollover is not possible for now, but we are
working on this feature for future versions of Knot DNS.
With manual policy, one can perform the (ZSK or KSK) rollover by
carefully setting keys' timing parameters appropriately with keymgr. See
'man keymgr' commands 'zone key generate' and 'zone key set'.
It's quite
difficult to do this correctly though.
Regarding SEP, you just seem to forget 'ksk' parameter:
keymgr zone key generate manual.test ksk algorithm ECDSAP256SHA256 size 256
BR,
Libor
Dne 28.4.2017 v 08:43 Volker Janzen napsal(a):
Hi all,
I'm currently looking for alternatives which do automatic DNSSEC
signing as a master DNS server. I run a Knot secondary instance and
added a manual and auto signing zone, because I want to understand the
differences and which is better for my needs.
I added this to my knot.conf
policy:
- id: rsa
algorithm: RSASHA256
ksk-size: 2048
zsk-size: 1024
- id: manual
manual: on
zone:
- domain: "auto.test."
file: "/etc/knot/master/auto.test.zone"
dnssec-signing: on
dnssec-policy: default
- domain: "manual.test."
file: "/etc/knot/master/manual.test.zone"
dnssec-signing: on
dnssec-policy: manual
I'm not sure about how some things work, perhaps someone can answer my
questions.
When auto signing is used, the ZSKs are rolled automated? And the KSK
rollover is not possible at all? Even not manual?
For manual mode, I followed these steps to generate the keys:
$ keymgr zone key generate manual.test algorithm RSASHA256 size 1024
$ keymgr zone key generate manual.test algorithm ECDSAP256SHA256 size 256
This results in
dig @localhost DNSKEY manual.test +short
256 3 8 AwEAAbGES3TH8jPCIhcdc93dbDNoUkDn5YmviG2/lkCESDcIvzpRFjsC
ATAZEIEo1LosM6cALS8AVkxKK/BSOpuvLHvhX7O+ny7eX5X/C2PHnGs+
WMieIhbjLJWdIsNCMhSqQ7vTlguFmHbUdyzV+8dnrMl1GSpdSc1P0Fyp vjxDM5+H
256 3 13 H+qtCYv9A0RlqQCOtDyGGEMhVgn92wPdZ+WrqRAqb/MJ3RzdDSyhaX2p
B/TU5F8mQccrVIdiJriT+zmWpoW9sA==
I don't understand why there is no DNSKEY with SEP set. Shouldn't it
be there?
Regards,
Volker
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users