bind makes RRSIG disappear?

2011-02-06 Thread Gilles Massen
Hello, I have a very peculiar behavior: a zone, signed by OpenDNSSEC and pushed to Bind 9.7.2-P3 by scp was working fine. But now, completely out of the blue, Bind decides to claim some authority over the zone: the SOA RRSIG (only that one) is scrapped, and this is logged: 06-Feb-2011 15:10:

Re: bind makes RRSIG disappear?

2011-02-06 Thread Chris Thompson
On Feb 6 2011, Gilles Massen wrote: I have a very peculiar behavior: a zone, signed by OpenDNSSEC and pushed to Bind 9.7.2-P3 by scp was working fine. But now, completely out of the blue, Bind decides to claim some authority over the zone: the SOA RRSIG (only that one) is scrapped, and this is

Re: bind makes RRSIG disappear?

2011-02-06 Thread Gilles Massen
Chris, thanks for the hint, but: On 6/2/11 19:20 , Chris Thompson wrote: On Feb 6 2011, Gilles Massen wrote: I have a very peculiar behavior: a zone, signed by OpenDNSSEC and pushed to Bind 9.7.2-P3 by scp was working fine. But now, completely out of the blue, Bind decides to claim some auth

Re: bind makes RRSIG disappear?

2011-02-06 Thread Mark Andrews
Mark Andrews writes: > > In message <4d4ef872.6070...@restena.lu>, Gilles Massen writes: > > Chris, > > > > thanks for the hint, but: > > > > > > On 6/2/11 19:20 , Chris Thompson wrote: > > > On Feb 6 2011, Gilles Massen wrote: > > > > > >> I have a very peculiar behavior: a zone, signed by Op

Re: bind makes RRSIG disappear?

2011-02-06 Thread Mark Andrews
In message <4d4ef872.6070...@restena.lu>, Gilles Massen writes: > Chris, > > thanks for the hint, but: > > > On 6/2/11 19:20 , Chris Thompson wrote: > > On Feb 6 2011, Gilles Massen wrote: > > > >> I have a very peculiar behavior: a zone, signed by OpenDNSSEC and > >> pushed to Bind 9.7.2-P3 by

Re: bind makes RRSIG disappear?

2011-02-06 Thread Gilles Massen
Mark, On 02/06/2011 10:41 PM, Mark Andrews wrote: > Mark Andrews writes: >> >>> Does your configuration also have an "allow-update" setting (other than "none") for it, maybe only for the instance that is giving you trouble? In that case BIND will take it that you want it to do

Re: bind makes RRSIG disappear?

2011-02-07 Thread Cathy Almond
Hi Gilles, You've identified a corner-case bug - the logic is incorrect in the case where the ACL holds "none" instead of being empty. There's no compile-time option - but we are treating what you've reported to us as a bug (RT #23120). It is currently under investigation/discussion. Many thank

Re: bind makes RRSIG disappear?

2011-02-07 Thread Evan Hunt
> Thanks, this works indeed. > > This raises a few questions, as I'd really like to understand bind's > behavior: > > - is there any description of exactly how/when Bind assumes signing > authority over a zone? Or simply where some kind of zone-manipulating > intelligence kicks in? > > - is it p

Re: bind makes RRSIG disappear?

2011-02-07 Thread Gilles Massen
Evan, Thanks for outlining this - it's much clearer now. BIND will try to maintain the signatures in a zone if the zone is configured to be dynamic--i.e, if it has an update-policy or allow-update option. It won't create signatures where there were none, but it will try to keep existing RRSIGs

Re: bind makes RRSIG disappear?

2011-02-07 Thread Evan Hunt
> >BIND will try to maintain the signatures in a zone if the zone is > >configured to be dynamic--i.e, if it has an update-policy or allow-update > >option. It won't create signatures where there were none, but it will try > >to keep existing RRSIGs up to date for you. > > Not that I would need i