On 2016-03-10 08:12, Havard Eidnes wrote:
If key_pair_id = 0 is indeed invalid, I guess the database has gotten
into a state where OpenDNSSEC refuses to mend it automatically.
Guidance sought.
Listing all the keys with "ods-ksmutil key list --verbose --all"
revealed:
NOT ALLOCATED KSK generate (not
scheduled) (publish) 2048 8
3b929d0ab308b4e1e8bf81abf1e6dafe SoftHSM
NOT ALLOCATED ZSK generate (not
scheduled) (publish) 1024 8
b3c5b3d619c086f41f3f2ed440419f23 SoftHSM
I ran into a similar problem last night. Long ago, I had incorrectly
deleted a zone I was using for testing, resulting in a few keys I could
not delete, but were reported against the 'NOT ALLOCATED'. I found
myself unable to delete the key because it was in a 'publish' state for
a zone that no longer existed, so I left it.
Everything worked fine, until last night when my KSK finally rolled
over. The KSK that was previously active had a lower primary key than
the "NOT ALLOCATED" key, but my new KSK had a larger primary key.
When the rollover happend, signerd crashed. After restarting ODS, I was
unable to get it to publish a DNSKEY record for the new KSK on the
working domain, even though it was publishing the DS record for the key.
I started working on exporting the existing database so I could back it
up, wipe it, and restore it. This is when I noticed that `ods-ksmutil
key export --all` was writing out the first couple keys but when it got
to the "NOT ALLOCATED" key, it stopped; I don't have the exact error but
it was something along the lines of 'Error invalid index -1, stopping'.
I'm guessing that the DNSKEY for my new KSK wasn't being output to the
zone file because of this problem.
To fix it, I shut down ODS, opened the kasp.db file in sqlite and
deleted the busted key from the `keypairs` table. Lo and behold,
'ods-ksmutil key export' worked, and soon enough my zone finally had a
DNSKEY for my new KSK.
--Kevin Thompson
_______________________________________________
Opendnssec-user mailing list
[email protected]
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
