On 01/27/2011 11:37 PM, bert hubert wrote: > Hi everybody, > > (the short version, there is a snapshot worth looking at, packages on > http://powerdnssec.org/downloads - documentation on http://powerdnssec.org ) > > Since our previous 'PowerDNSSEC' announcement, a lot has happened. > PowerDNSSEC now offers support for almost all DNSSEC algorithms standardised > (RSASHA1, RSASHA256, RSASHA512, GOST), and even for some that aren't yet > (ECDSA). > > In addition, we've added support for pre-signed zones, so you can now slave > signed zones from non-PowerDNS installations, and serve them. The other way > around works too, you can slave unsigned zones and serve them with DNSSEC > added to it, as a front-proxy. > > Finally, there is now a lot of documentation, a good place to start reading > is still http://powerdnssec.org. > > Today, we've released snapshot 20110127.1921 which is in reasonably wide > production. It powers every single access to the PowerDNS Wiki and the > PowerDNS Subversion repository. > > Packages for 32 bit and 64 bit Linux distributions, plus source, can be > found on http://powerdnssec.org/downloads > > We urge everybody with an interest in DNSSEC to give this snapshot and its > associated documentation a go, if only to find out if it would 'work for > you'. Hi Bert and others,
So I wanted to atleast do a quick test last night. So I downloaded the static 64-bit .deb and installed it on my 64-bit Ubuntu 10.10 desktop. But it did not work. Eventually I found some of the problems, but a CNAME problem remained. I have some suggestions as well. I didn't want to setup a mysql or postgresql database, but first try to setup the bind backend. I've not created a bind zone file in ages, so I did a quick dig AXFR of an existing zone in production and removed and replaced a lot of stuff, this was the result: test.net. 14400 IN SOA ns1.test.net. hostmaster.test.net. 2011012731 10800 3600 604800 38400 test.net. 14400 IN NS ns2.test.net. test.net. 14400 IN NS ns1.test.net. test.net. 14400 IN NS ns3.test.net. ns1.test.net. 3600 IN A 10.0.0.101 ns2.test.net. 3600 IN A 10.0.0.102 ns3.test.net. 3600 IN A 10.0.1.13 web.test.net. 3600 IN A 10.0.0.238 www.test.net. 3600 IN CNAME web.test.net. test.net. 14400 IN MX 100 mx1.test.net. test.net. 14400 IN MX 100 mx2.test.net. test.net. 14400 IN MX 400 mx3.test.net. test.net. 14400 IN MX 400 mx4.test.net. mx1.test.net. 3600 IN A 10.0.0.111 mx2.test.net. 3600 IN A 10.0.0.112 mx3.test.net. 3600 IN A 10.0.0.116 mx4.test.net. 3600 IN A 10.0.0.117 I created a named.conf: zone "test.net" { type master; file "/etc/powerdns/zones/test.net"; }; and added these settings to pdns.conf: local-address=127.0.0.1 launch=bind bind-config=/etc/powerdns/named.conf Everything seemed to work fine. I tested this by sending: dig +norec @127.0.0.1 www.test.net. A I got the CNAME and the A-record of web.test.net as result as expect. So just running the bind-backend seemed to work just fine. If I don't want to setup a whole database server, for DNSSEC I would need sqlite or sqlite3. First problem: what do I need to specify at the launch parameter ?: sqlite or sqlite3 ? I checked pdns_server --list-modules gsqlite or gsqlite3 I guess if I use the 'sqlite3' command to create the database I'll use gsqlite3. So I added that to the launch setting: launch=gsqlite3,bind created a database: http://doc.powerdns.com/gsqlite.html#id621028 (gsqlite / Setting up the database) And added the dnssec changes: http://wiki.powerdns.com/trac/export/1922/trunk/pdns/pdns/dnssec.schema.sqlite3.sql Added to the config: gsqlite3-database=/etc/powerdns/sql/powerdns.sqlite3 gsqlite3-dnssec Everything still worked. As I understand it, it is possible to use bind-zones and sqlite3 to store the keys. So I ran the commands: $pdnssec secure-zone test.net This should not happen, still no key! So I ran check-zone: $pdnssec check-zone test.net no nsec3 for test.net Jan 28 10:39:17 [bindbackend] Done parsing domains, 0 rejected, 1 new, 0 removed Checked 17 records, 0 errors Still the same error when I ran pdnssec secure-zone test.net So I try: $ pdnssec rectify-zone test.net no nsec3 for test.net Jan 28 10:41:46 [bindbackend] Done parsing domains, 0 rejected, 1 new, 0 removed Adding NSEC ordering information Done listing so I run: $ echo .dump | sqlite3 /etc/powerdns/sql/powerdns.sqlite3 2>&1 | less -I Nothing was added to the database. So I run pdnssec secure-zone test.net Still the same: This should not happen, still no key! Now I think, well, maybe I should just move everything over to the sqlite3-database instead. As I've never created a sqlite3-database for powerdns before yesterday I create one without dnssec first. So I run zone2sql without the DNSSEC. I disabled/change the settings: #gsqlite3-dnssec #bind-config launch=gsqlite3 Look at the a .dump, it looks fine. Run a dig and spot an other problem: ;; ANSWER SECTION: www.test.net. 3600 IN CNAME web.test.net. Just the CNAME, no A-record. This seems wrong, I think it is an ordering problem. So I add the dnssec-schema and enable: gsqlite3-dnssec Again and run: pdnssec rectify-zone test.net Now it worked: ;; ANSWER SECTION: www.test.net. 3600 IN CNAME web.test.net. web.test.net. 3600 IN A 10.0.0.238 But still signing does not work: $ pdnssec secure-zone test.net This should not happen, still no key! And I go to bed because it is late. :-/ This morning I tried running the bind and sqlite3 again but changed: launch=bind,gsqlite3 That did not help. Then I figured out the problem, I forgot to add to the domains-table. So I have 2 suggestions: 1. add the insert into domain line to zone2sql 2. the documentation should be changed from: $ echo 'insert into domains (name, type) values ('powerdnssec.org', 'NATIVE') | sqlite3 ./powerdns.sqlite3 to: $ echo "insert into domains (name, type) values ('powerdnssec.org', 'NATIVE')" | sqlite3 ./powerdns.sqlite3 So I retested, but the problem with the CNAME and sqlite3 remained when running without a DNSSEC-schema and gsqlite3-dnssec-setting. After ordering and singing and ordering the DNSSEC the CNAME problems all went away and when I run dig with +trusted-key= and everything worked. It also worked with or without the bind backend. Have a nice day, Leen Besselink. _______________________________________________ Pdns-users mailing list Pdns-users@mailman.powerdns.com http://mailman.powerdns.com/mailman/listinfo/pdns-users