Hello List,
I would like to install KNOT-resolver, first test it with DNS over TLS, but
that doesn't work?
My system is an oracle Linux 8.4
I have a Letsencrypt certificate for this system and wanted to integrate it
into kresd, but I get a GNUTLS error?
Sep 22 18:27:30 bbs kresd[446005]: [tls ]
gnutls_certificate_set_x509_key_file(/etc/letsencrypt/live/bbs.xxxx.xxxx/
fullchain_ecdsa.pem,/etc/pki/private/xxxx.xxxx_ec.key) failed: -64
(GNUTLS_E_FILE_ERROR)
Sep 22 18:27:30 bbs kresd[446005]: [system] error while loading config: error
occurred here (config filename:lineno is at the bottom, if config is
involved):#012stack traceback:#012#011[C]: in function 'tls'#012#011/etc/knot-
resolver/kresd.conf:24: in main chunk#012ERROR: Invalid argument (workdir '/
var/lib/knot-resolver')
Sep 22 18:27:30 bbs systemd[1]: kresd(a)1.serbice.service: Main process exited,
code=exited, status=1/FAILURE
Does this not work with a Letsenkrypt certificate or I have another error in
my configuration
My config
-- SPDX-License-Identifier: CC0-1.0
-- vim:syntax=lua:set ts=4 sw=4:
-- Refer to manual: https://knot-resolver.readthedocs.org/en/stable/
-- Uncomment this only if you need to debug problems
-- verbose(true)
log_level('debug')
-- Network interface configuration
net.listen('127.0.0.1', 53, { kind = 'dns' })
net.listen('127.0.0.1', 853, { kind = 'tls' })
--net.listen('127.0.0.1', 443, { kind = 'doh2' })
net.listen('::1', 53, { kind = 'dns', freebind = true })
net.listen('::1', 853, { kind = 'tls', freebind = true })
--net.listen('::1', 443, { kind = 'doh2' })
net.listen('xxx.xxx.xxx.1', 53, { kind = 'dns' })
net.listen('xxx.xxx.xxx.1', 853, { kind = 'tls' })
net.listen('192.168.100.200', 53, { kind = 'dns' })
net.listen('192.168.100.200', 853, { kind = 'tls' })
net.listen('xxx:xxxx:xxxx:xxx::200', 53, { kind = 'dns' })
net.listen('xxx:xxxx:xxxx:xxx::200', 853, { kind = 'tls' })
-- DNS over TLS
net.tls("/etc/letsencrypt/live/bbs.xxxx.xxx/fullchain_ecdsa.pem", "/etc/pki/
tls/private/xxxx.xxx_ec.key")
-- Load useful modules
modules = {
'hints > iterate', -- Load /etc/hosts and allow custom root hints
'stats', -- Track internal statistics
'predict', -- Prefetch expiring/frequent records
}
I heard / read from a user that knot resolver must have its own rights for the
certificate, but that is not possible, because the key is also intended for
other computers and this creates a system risk? Is this a design problem or a
bug?
Thanks for an answer,
--
mit freundlichen Grüßen / best regards
Günther J. Niederwimmer
On 24/09/2021 14.29, Günther J. Niederwimmer wrote:
> I mean my cert and key are are equipped with "standard" rights ?
>
> Knot-resolver can't handle it ?
It does not run under "root" user or group (by default), so in your
settings it won't be able to read them.
--Vladimir
Hi,
I'm having trouble reading the documentation for Lua modules, is it
possible to issue multiple recursive queries and await all of the
results?
What I'm trying to achieve is a CNAME glue-zone, d.example.com, that
searches in several other zones (phy.example.com, vm.example.com,
ad.example.com, etc) and returns a CNAME record into the one with the
highest priority (configurable, probably just a list) that does not
reply with a NXDOMAIN.
I'd like to do all the recursions in parallel, to keep users as happy
as possible.
Configuration might look something like this:
local zones = {
["d.example.com"] = {
"phy.example.com",
"vm.example.com",
"ad.example.com"
},
["vm.example.com"] = {
"vmware.vm.example.com",
"hyperv.vm.example.com"
}
}
/Erik
() ascii ribbon - against html e-mail
/\ arc.pasp.de - against proprietary attachments
Hello,
it seems that Knot Resolver doesn't responde for DNS ANY queries or it does?
Unable to found how to set it up in documentaction.
Thank you for you help
Michal
Hello,
it seems that Knot Resolver doesn't responde for DNS ANY queries or it does?
Unable to found how to set it up in documentaction.
Thank you for your help
Michal
Dear Knot Resolver users,
Knot Resolver 5.4.0 has been released! It comes with improved logging
facilities and new debugging options.
Improvements
------------
- fine grained logging and syslog support (!1181)
- expose HTTP headers for processing DoH requests (!1165)
- improve assertion mechanism for debugging (!1146)
- support apkg tool for packaging workflow (!1178)
- support Knot DNS 3.1 (!1192, !1194)
Bugfixes
--------
- trust_anchors.set_insecure: improve precision (#673, !1177)
- plug memory leaks related to TCP (!1182)
- policy.FLAGS: fix not applying properly in edge cases (!1179)
- fix a crash with older libuv inside timer processing (!1195)
Incompatible changes
--------------------
- see upgrading guide:
https://knot-resolver.readthedocs.io/en/stable/upgrading.html#to-5-4
- legacy DoH implementation configuration in net.listen() was renamed
from kind="doh" to kind="doh_legacy" (!1180)
Full changelog:
https://gitlab.nic.cz/knot/knot-resolver/raw/v5.4.0/NEWS
Sources:
https://secure.nic.cz/files/knot-resolver/knot-resolver-5.4.0.tar.xz
GPG signature:
https://secure.nic.cz/files/knot-resolver/knot-resolver-5.4.0.tar.xz.asc
Documentation:
https://knot-resolver.readthedocs.io/en/v5.4.0/
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
Hello all,
I've recently switched from the unbound resolver
to the knot resolver for all outgoing name resolution on
one of my FreeBSD servers. It all works pretty much as
expected. With one problem; initializing and terminating
kresd isn't possible w/o adding some external scripting.
Given that the BSDs don't come w/systemd. Are there any
plans to better support the sysv init system in the knot
resolver?
Thanks in advance for any hints/pointers/solutions. :-)
--Chris
Hi,
I recently stumbled about the following issue with postfix:
DANE TLSA lookup problem: Host or domain name not found. Name service
error for name=_25._tcp.smtp-relay-in-s1.neusta.de type=TLSA: Host not
found, try again
Postfix uses knot-resolver and I found [1] as a possible similar issue
with unbound.
I would like to test if the issue persists with disabled qname
minimization, but it seems to be no configurale option.
Kind Regards
Bjoern
[1]
http://postfix.1071664.n5.nabble.com/Mail-deferred-TLSA-lookup-error-td1074…
