20 Bře
2026
20 Bře
'26
14:21
Hi,
I am trying to make a small tutorial for different resolvers on how to
check that the Root KSK is updated.
How can I check that for Knot resolver?
Kind regards from sunny Stockholm
Ulrich
23 Bře
23 Bře
16:00
On 20/03/2026 14.21, Ulrich Wisser via knot-resolver-users wrote:
I am trying to make a small tutorial for different
resolvers on how to
check that the Root KSK is updated.
How can I check that for Knot resolver?
I wonder. We have an automatic check which should detect it and log a
warning during startup by default:
log_warn(ffi.C.LOG_GRP_TAUPDATE, 'you need to
update package with
trust anchors in "%s" before it breaks', file_name)
So maybe that's the best way. Knot Resolver is normally packaged to
either (1) use root trust anchors shipped with it - in which case users
should be fine unless using a rather old version (which will have
security issues anyway). As for the currently new KSK, we were adding
that in the 2024 Summer.
Or (2) it uses root trust anchors which have a separate package in that
distro (e.g. Debian and derivatives), in which case I really hope that
the distro packagers won't forget, especially when speaking of
long-term-supported distros (say Ubuntu 24.04).
--Vladimir
16:22
Hi Vladimir,
thank you! I'll include that.
I was hoping for a command to check if my running resolver really has
the keys.
E.g. unbound supports "dig @address trustanchor.unbound -c CH -t TXT",
bind has "rndc secroots"
Makes it relatively easy to know that everything is in order.
/Ulrich
Am 23.03.26 um 16:00 schrieb Vladimír Čunát:
On 20/03/2026 14.21, Ulrich Wisser via
knot-resolver-users wrote:
I am trying to make a small tutorial for
different resolvers on how
to check that the Root KSK is updated.
How can I check that for Knot resolver?
I wonder. We have an automatic check which should detect it and log a
warning during startup by default:
log_warn(ffi.C.LOG_GRP_TAUPDATE, 'you
need to update package with
trust anchors in "%s" before it breaks', file_name)
So maybe that's the best way. Knot Resolver is normally packaged to
either (1) use root trust anchors shipped with it - in which case
users should be fine unless using a rather old version (which will
have security issues anyway). As for the currently new KSK, we were
adding that in the 2024 Summer.
Or (2) it uses root trust anchors which have a separate package in
that distro (e.g. Debian and derivatives), in which case I really hope
that the distro packagers won't forget, especially when speaking of
long-term-supported distros (say Ubuntu 24.04).
--Vladimir
18:20
On 23/03/2026 16.22, Ulrich Wisser wrote:
I was hoping for a command to check if my running
resolver really has
the keys.
I assumed so, but... currently it requires using internals which aren't
meant to be long-term stable. (though in this case it's unlikely that
they'd change within a year or two)
In usual installation of v6 it should work to run:
$ echo 'trust_anchors.summary()' | sudo socat - /run/knot-resolver/control/0
'. 86400 DNSKEY 257 3 8
AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
; Valid: ; KeyTag:20326
. 86400 DNSKEY 257 3 8
AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=
; Valid: ; KeyTag:38696
'
⏎
The exact location of a suitable socket path (used above) may vary
slightly, as it's somewhat configurable and I think it usually differed
slightly before v6.
3
days inactive
6
days old
knot-resolver-users@lists.nic.cz
3 comments
2 participants
participants (2)
-
Ulrich Wisser -
Vladimír Čunát