Groups > comp.protocols.dns.bind > #15937

AW: How to prepublish additional DNSKEY

Path	csiph.com!news.uzoreto.com!paganini.bofh.team!news.killfile.org!usenet.stanford.edu!not-for-mail
From	Klaus Darilion <klaus.darilion@nic.at>
Newsgroups	comp.protocols.dns.bind
Subject	AW: How to prepublish additional DNSKEY
Date	Thu, 9 Jul 2020 11:51:03 +0200
Lines	19
Approved	bind-users@lists.isc.org
Message-ID	<mailman.657.1594288242.942.bind-users@lists.isc.org> (permalink)
References	<3E18C1A0C550C44DA156DA5DA8ECCC6AB622808F@NICS-EXCH2.sbg.nic.at> <alpine.DEB.2.20.2007081628490.9145@grey.csi.cam.ac.uk> <3E18C1A0C550C44DA156DA5DA8ECCC6AB622A510@NICS-EXCH2.sbg.nic.at>
NNTP-Posting-Host	lists.isc.org
Mime-Version	1.0
Content-Type	text/plain; charset="us-ascii"
Content-Transfer-Encoding	quoted-printable
X-Trace	usenet.stanford.edu 1594288276 9460 149.20.1.60 (9 Jul 2020 09:51:16 GMT)
X-Complaints-To	action@cs.stanford.edu
Cc	"bind-users@lists.isc.org" <bind-users@lists.isc.org>
To	Tony Finch <dot@dotat.at>
Return-Path	<klaus.darilion@nic.at>
X-Original-To	bind-users@lists.isc.org
Delivered-To	bind-users@lists.isc.org
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=nic.at; s=it2019; h=From:From:To:CC:Subject:Date:Message-Id:Content-Type:Received:Received; bh=9xvxl/Ms8EWb2y8qamIk7keZTd29lGqr2/aTHaVAh/g=; b=HTzTMvvDDQgvpRU+f7yUBMTlfOHUuJMUE4RDiDhZPqxTqL9snPTdT7ChTk2XSbtDLv1b0sms/CRJDCHXPoNStypJHUjiWbuxQPjBE815woQ6fE+CLQmBQmsvzERoFgXYHg6o4yXinlQ57ZPtHudpiOnevvT5nlLrQGnsZUEIQgdWMp5CHhy7frL8g0OjQ3KvWxnw4Z3qeNH/p6b8H/ZCeyCwMuBRUfIvFZtfQHg9ikH5zeXUv/mYi96PL6nNGyLnDLuUb8mImGahmlOtJEm7qmcfEm+6eaf2XUNP751nuG2E1WSzxtYtgsym9PSNb8XPqbC0KvsjD7wAKBpRYXba9Q==;
Thread-Topic	How to prepublish additional DNSKEY
Thread-Index	AdZVBFvzLSjkENOpTXuVkOraJnUuBAAJ93OAACpSN0A=
In-Reply-To	<alpine.DEB.2.20.2007081628490.9145@grey.csi.cam.ac.uk>
X-MS-Has-Attach
X-MS-TNEF-Correlator
x-originating-ip	[192.168.7.4]
X-Assembled-By	XWall v3.56
X-XWALL-BCKS	auto
X-Spam-Status	No, score=-5.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS autolearn=disabled version=3.4.2
X-Spam-Checker-Version	SpamAssassin 3.4.2 (2018-09-13) on mx.pao1.isc.org
X-BeenThere	bind-users@lists.isc.org
X-Mailman-Version	2.1.29
Precedence	list
List-Id	BIND Users Mailing List <bind-users.lists.isc.org>
List-Unsubscribe	<https://lists.isc.org/mailman/options/bind-users>, <mailto:bind-users-request@lists.isc.org?subject=unsubscribe>
List-Archive	<https://lists.isc.org/pipermail/bind-users/>
List-Post	<mailto:bind-users@lists.isc.org>
List-Help	<mailto:bind-users-request@lists.isc.org?subject=help>
List-Subscribe	<https://lists.isc.org/mailman/listinfo/bind-users>, <mailto:bind-users-request@lists.isc.org?subject=subscribe>
X-Mailman-Original-Message-ID	<3E18C1A0C550C44DA156DA5DA8ECCC6AB622A510@NICS-EXCH2.sbg.nic.at>
X-Mailman-Original-References	<3E18C1A0C550C44DA156DA5DA8ECCC6AB622808F@NICS-EXCH2.sbg.nic.at> <alpine.DEB.2.20.2007081628490.9145@grey.csi.cam.ac.uk>
Xref	csiph.com comp.protocols.dns.bind:15937

Show key headers only | View raw

> > So, how is the correct process to add an additional DNSKEY (only the public
> key is known).
> 
> I think you are looking for `dnssec-importkey`.

Indeed. I imported the key and got a .key and .private file. I put those files in the same directory as the other keys, gave read permissions to bind and executed:
rndc loadkeys myzone
rndc sign myzone

But the additional key is not added to the reponse of DNSKEY queries.

I am using Bind - 9.12.2-P2. Is this supported by Bind 9.12? (upgrade/downgrade is currently not possible)

Thanks
Klaus

Back to comp.protocols.dns.bind | Previous | Next | Find similar

Thread

AW: How to prepublish additional DNSKEY Klaus Darilion <klaus.darilion@nic.at> - 2020-07-09 11:51 +0200

csiph-web