Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.protocols.dns.bind > #93

Re: OT: Bind 9.9.0B1 Inline-Signing Question

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Do you see that each time named starts or just on the first load of the zone?  What happens if you send a query to the server with dig +dnssec?



On Nov 10, 2011, at 14:23, "McConville, Kevin" <kmcconville@albany.edu> wrote:

> I know that this isn’t the forum for betas, which is why I put off-topic on the subject line.  We are trying to implement DNSSEC for our static zones. While the dynamic signing has been automated, static inline-signing isn’t available until Bind 9.9
>  
> We have been testing with the alphas and now with the beta. What we are seeing is that whenever named starts, it initially creates the signed static zone file, but never really finishes. The logging shows:
>  
> 10-Nov-2011 14:38:14.766 general: error: zone xxxxxx.org/IN (signed): not loaded due to errors.
> 10-Nov-2011 14:38:14.766 general: info: zone localhost/IN: loaded serial 42
> 10-Nov-2011 14:38:14.767 general: notice: all zones loaded
> 10-Nov-2011 14:38:14.768 general: notice: running
> 10-Nov-2011 14:38:14.768 general: info: zone xxxxxx.org/IN (signed): loaded serial 2011110905
> 10-Nov-2011 14:38:14.768 notify: info: zone xxxxxx.org/IN /IN (signed): sending notifies (serial 2011110905)
>  
> So, it doesn’t load the zone due to errors, but then later claims to load the same zone file.
>  
> Has anyone been able to get the inline-signing  function to work? I’ve triple-checked my named.conf, ran named-checkzone, went to a vanilla zone file, and even tested the zone file as dynamic (which worked).
>  
> Any ideas or suggestions of where to check next are greatly appreciated.
>  
> Thanks,
>  
> -Kevin
>  
> Kevin McConville
> University at Albany
>  
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> 
> bind-users mailing list
> bind-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users

Back to comp.protocols.dns.bind | Previous | Next | Find similar

Thread

Re: OT: Bind 9.9.0B1 Inline-Signing Question Michael Graff <mgraff@isc.org> - 2011-11-10 14:42 -0600

csiph-web