Thanks to Evan for the last look and thanks to Jan-Piet for the suggestion
to go to 9.10.2.

Being that I'm working on a laptop (hence on on over the weekend) I've had
to recreate the environment today.  I'm a bit more puzzled now.

I've built and installed BIND 9.10.2.  Using http://keyroll.systems,
there's a page showing the BIND config and it seems to have the current
key there.  (I thought the page was static.)  I guess I'm just a bit
surprised, anyway, I have that key in place.

And - I've also updated by unbound, I do get an 'ad' bit for "./IN/SOA".
(I need to figure out why I needed to update unbound - perhaps it is that
I'm on a laptop and not a 24x7 machine, but I can get it to validate.)

Ugly details below:

This time I do see an error upon startup:

$ named -g -c rfc5011.conf
20-Apr-2015 14:34:18.432 starting BIND 9.10.2 -g -c rfc5011.conf
20-Apr-2015 14:34:18.432 built with '--with-openssl=/usr/local/ssl'
'STD_CDEFINES=-DDIG_SIGCHASE=1'
20-Apr-2015 14:34:18.432
----------------------------------------------------
20-Apr-2015 14:34:18.432 BIND 9 is maintained by Internet Systems
Consortium,
20-Apr-2015 14:34:18.432 Inc. (ISC), a non-profit 501(c)(3) public-benefit
20-Apr-2015 14:34:18.432 corporation.  Support and training for BIND 9 are
20-Apr-2015 14:34:18.432 available at https://www.isc.org/support
20-Apr-2015 14:34:18.432
----------------------------------------------------
20-Apr-2015 14:34:18.432 found 4 CPUs, using 4 worker threads
20-Apr-2015 14:34:18.432 using 2 UDP listeners per interface
20-Apr-2015 14:34:18.433 using up to 4096 sockets
20-Apr-2015 14:34:18.439 loading configuration from
'/Users/edwardlewis/Documents/DNS/secure_BIND_resolver/rfc5011.conf'
20-Apr-2015 14:34:18.439 reading built-in trusted keys from file
'/etc/bind.keys'
20-Apr-2015 14:34:18.439 using default UDP/IPv4 port range: [49152, 65535]
20-Apr-2015 14:34:18.440 using default UDP/IPv6 port range: [49152, 65535]
20-Apr-2015 14:34:18.440 listening on IPv6 interface lo0, ::1#1053
20-Apr-2015 14:34:18.442 listening on IPv4 interface lo0, 127.0.0.1#1053
20-Apr-2015 14:34:18.442 generating session key for dynamic DNS
20-Apr-2015 14:34:18.443 sizing zone task pool based on 1 zones
20-Apr-2015 14:34:18.445 set up managed keys zone for view recursive, file
'21ce078705d04ca6324c1d0313fc08ea99f3cef6389a6744d40bd2d9d0cd7816.mkeys'
20-Apr-2015 14:34:18.445 automatic empty zone: view recursive:
10.IN-ADDR.ARPA...yadda...yadda...yadda...
20-Apr-2015 14:34:18.449 command channel listening on 127.0.0.1#1953
20-Apr-2015 14:34:18.449 not using config file logging statement for
logging due to -g option
20-Apr-2015 14:34:18.449 managed-keys-zone/recursive: loaded serial 3
20-Apr-2015 14:34:18.460 all zones loaded
20-Apr-2015 14:34:18.460 running
20-Apr-2015 14:34:18.554 validating ./DNSKEY: unable to find a DNSKEY
which verifies the DNSKEY RRset and also matches a trusted key for '.'
20-Apr-2015 14:34:18.554 no valid KEY resolving './DNSKEY/IN':
204.42.252.20#53
20-Apr-2015 14:34:18.554 broken trust chain resolving './NS/IN':
204.42.252.20#53

My rfc5011.conf file is:

$ cat rfc5011.conf 
options
{
        dnssec-enable yes;
        dnssec-validation yes;
        pid-file none;
        session-keyfile "session.key";
        notify no;
        listen-on port 1053 { 127.0.0.1; };
        listen-on-v6 port 1053 { ::1; };
};

key "rndc-key"
{
      algorithm hmac-md5;
      secret "cuxAvCYntho2ia6jhDM4yw==";
};

controls
{
      inet 127.0.0.1 port 1953
              allow { 127.0.0.1; } keys { "rndc-key"; };
};

managed-keys {
      . initial-key 257 3 8
"AwEAAaTCfs92ag0oZpg/uzN7NcN2aIXZxR7Q1XOin8eEei+QPR0dXrI7
DskSUNVBsHMS6piMCTQRqFHq1TwY19tWiJJf0meZWRMWTOrzyFd/Tioa
KwWTga0bNN09dciQmNxJyfnHDNfqJ8k3LeQz8WHQzc9QC0x8cOmT1IG7
yn+0S6QFl4/G6uwBxJ3ejxdiygJQKa8i3YAv3EEKP066YuRki5h1yz93
P9UEyU2E2MOByqMJtgpaBPbOX5riTdaTu5gXKnoJyag//545+Z43+Y6u
+wQzfnFFhWHzQiH8Yl3y4qNuBVXSvlmg9XU4LhT7EqTA+v5v/O2Humkm
KqetoGkEbJ0=";
};

view "recursive" IN {
    match-clients { any; };
    allow-query   { any; };
    recursion yes;

    allow-recursion { any; };

    // prime the server with the RFC5011 Key roll server.
    zone "." {
       type hint;
       file "keyroller-db.root";
    };    

};  // End of recursive view.


The current dig "fake-. dnskey" is:


$ dig @204.42.252.20 . dnskey

; <<>> DiG 9.10.2 <<>> @204.42.252.20 . dnskey
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16270
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;.                              IN      DNSKEY

;; ANSWER SECTION:
.                       3600    IN      DNSKEY  385 3 8
AwEAAb1tBF4Fbnx8Wx4dDpoMbeKpId70bZyWRzz07uORb5ZrbgQfy8u1
sFH9k3kNsisc09CoG/aSGIsrEz0OueGHFDbwSWdaIwVFIpNRBwGQjbvf
pzod0HTfSo2Ka7oFBuc7Sm5CSjbxcXJ28FW9BCn/SboI1bw08R322rEy
oA1rwc8tDpyApUXP57fufe8Gd6X+nsT0ET+gUaGXx5R/zuusbfsXGrMp
d3GM2A1yDVylHs113W1C9xA2XW+BKtIlUWBoCwGuOQtbXEa5R0Q70LTN
MuV+EZqjo0Ko34qNQGKvOVOkUAVNc5IsQjrub6BJ2fCylcq/UmhdbUSY nlwkXjOZrNk=
.                       3600    IN      DNSKEY  256 3 8
AwEAAbe3RGCTHgumosDsXiQ3YLSEfuEMYx6PuXV4zAt4UiT60YTzUWRe
g5sfNSmPJsGvgiF6ge2rJpU3TdegFe06QWt3C3ZCVDL6RdCblbyPa9nH
QxurAn6lXmRz7wLETJ0l8EIyWsAC7kHkIIrE1g2LzbxdIBZbLfVAsMq2
HCL57eu+6O4tepDMHqODEaMMCi0aZqzJo/J+wtz+yr9JuDcHgimeAE+F
gpKzN6PBYzvvNEFjW0jOtfmLC1Gwmu4TgipYdZV/zUPFrLmGPRJpc8HW
NEyuZgAArqUzwNzGG7s7fFonRvcmWJRX98vN/LNH/bneKiMFIKEChxM7 LxUfhWbSgv8=
.                       3600    IN      DNSKEY  257 3 8
AwEAAaTCfs92ag0oZpg/uzN7NcN2aIXZxR7Q1XOin8eEei+QPR0dXrI7
DskSUNVBsHMS6piMCTQRqFHq1TwY19tWiJJf0meZWRMWTOrzyFd/Tioa
KwWTga0bNN09dciQmNxJyfnHDNfqJ8k3LeQz8WHQzc9QC0x8cOmT1IG7
yn+0S6QFl4/G6uwBxJ3ejxdiygJQKa8i3YAv3EEKP066YuRki5h1yz93
P9UEyU2E2MOByqMJtgpaBPbOX5riTdaTu5gXKnoJyag//545+Z43+Y6u
+wQzfnFFhWHzQiH8Yl3y4qNuBVXSvlmg9XU4LhT7EqTA+v5v/O2Humkm KqetoGkEbJ0=
.                       3600    IN      DNSKEY  257 3 8
AwEAAcmhtOXL8JnuQfDX2qXxUsgHRtjYZo2SOu9JYtYpK8VpI1kBohWO
ns4fVXVyAnxQIfLBgt0zaeMiom7W03BjrAD8WX1nbKF+8MeFFrtNimGL
uwmBtEPhyWAQcp+fMWEOJaLLfbfp3wUaAhwbTOnWDco5L/BMsQSgR3js
a+qqSUdbtoEiQrMcmH526CxG87b1Xo/YIS5LdIbTrlXwfHYhodjv7uYv
DursdjEF/f6GNMy8VDZ6ow3jjgXzAgsPQDnPu7otAta6BpKXQyAd5eVf
8QxhM3rhOQr8x/bb7Md/VAiqBUu00KnCqpXK3TIrTvdO7n192GgyoZw6 tdSFn7ejzDM=

;; Query time: 45 msec
;; SERVER: 204.42.252.20#53(204.42.252.20)
;; WHEN: Mon Apr 20 14:36:41 EDT 2015
;; MSG SIZE  rcvd: 1128

Attachment: smime.p7s
Description: S/MIME cryptographic signature

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
from this list

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Reply via email to