14 Pro
2020
14 Pro
'20
18:04
Hi Einar,
AFAIK using multiple parallel signers is an unexplored territory in DNS.
It's not difficult to ensure matching SOA serials, but having different
zone versions with same SOA serial is only asking for more trouble: what
if any secondary takes (for whatever reason) an IXFR from the other
signer than previously...
There is a way to sign zone deterministicly (either RSA or Deterministic
ECDSA), but whole DNSSEC relies on unix timestamp, and it seems not
viable to establish a second-precision sync among signers. There have
been thoughts about this previously, but none went far enough to be
adopted by Knot.
I agree it would be useful to have parallel signers, for the sake of
reliability, even better if they were of very different implementations.
But I haven't heard of any functioning setup. I assume most operators
simply rely on a single signer, while they are able to fix any issues
before the zone expires on public secondaries.
BR,
Libor
PS: it's both odd and inspiring how different TLD operators face
different issues and focus on different goals: .de strikes frequency of
updates, .be triple-checks that the zone was not signed incorrectly, .is
seeks assurance that the signer keeps running ... :)
Dne 14. 12. 20 v 10:26 Einar Bjarni Halldórsson napsal(a):
Hi,
We're migrating our signer from OpenDNSSEC to Knot 3.0. Our new design
will have one active signer and at least one backup signer. Zone data
is deployed from git to both signers. We've got syncing of the keys
working using `knotc zone-backup +nozonefile` and `knotc zone-restore
+nozonefile`. I'm still unsure of how hot to keep the standby. In the
dev env now I have the standby set to a manual dnssec policy to keep
it from rolling it's keys. The keys are synced from the active signer
every hour. Both the active and the backup signers are creating
signatures but SOA serials don't match. Both signers have
`serial-policy: dateserial` and `zonefile-sync: -1` but we're
considering adding `zonefile-load: difference-no-serial`.
We've discussed stopping signing on the backup altogether and
including the zonefiles in the backup. The problem we have with this
idea is that problems with signing on the backup won't be discovered
until it goes active.
Are other people doing active-backup signers and how do you set it up?
.einar