<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div>I have used opendnssec for a week or so but still have some issues. I think I am missing 1 thing to get it all going..</div><ul><li>it doesn't fetch the zone when I add it.</li><li>It doesn't make active KSK's</li><li>Using default policy (as installed from apt-get install opendnsdec from ppa's on opendnssec's website).</li></ul><div><div>ods-ksmutil zone add --zone spam.co.nz</div><div>zonelist filename set to /etc/opendnssec/zonelist.xml.</div><div>SQLite database set to: /var/lib/opendnssec/db/kasp.db</div><div>Imported zone: spam.co.nz</div></div><div><br></div><div><div># ods-ksmutil zone list</div><div>zonelist filename set to /etc/opendnssec/zonelist.xml.</div><div>SQLite database set to: /var/lib/opendnssec/db/kasp.db</div><div>Found Zone: spam.co.nz; on policy default</div></div><div><br></div><div>But the fetcher doesn't start up to fetch the file.</div><div><br></div><div>If I pdns_control notify-host spam.co.nz 114.23.20.4 opendnssec complains</div><div><br></div><div>Jun 22 10:54:45 opendnssec ods-signerd: zone fetcher notify received for unknown zone: spam.co.nz.</div><div><br></div><div><div># ods-ksmutil key list</div><div>SQLite database set to: /var/lib/opendnssec/db/kasp.db</div><div>Keys:</div><div>Zone: Keytype: State: Date of next transition:</div></div><div><br></div><div>Now if I ods-control stop.; ods-control start</div><div><br></div><div><div>ods-ksmutil key list</div><div>SQLite database set to: /var/lib/opendnssec/db/kasp.db</div><div>Keys:</div><div>Zone: Keytype: State: Date of next transition:</div><div>spam.co.nz KSK publish 2011-06-23 00:58:28 </div><div>spam.co.nz ZSK active 2011-07-22 10:58:28</div></div><div><br></div><div>And there is a file called spam.co.nz in /var/lib/opendnssec/signed</div><div><br></div><div>And if I run the pdns_control again</div><div><br></div><div><div>Jun 22 11:00:49 opendnssec ods-signerd: zone fetcher received NOTIFY for zone spam.co.nz</div><div>Jun 22 11:00:49 opendnssec ods-signerd: zone fetcher transferred zone spam.co.nz serial 1308697239 successfully</div><div>Jun 22 11:00:49 opendnssec ods-signerd: cmdhandler: zone spam.co.nz scheduled for immediate re-sign</div><div>Jun 22 11:00:49 opendnssec ods-auditor[23029]: Auditor started</div><div>Jun 22 11:00:49 opendnssec ods-auditor[23029]: Auditor starting on spam.co.nz</div><div>Jun 22 11:00:49 opendnssec ods-auditor[23029]: SOA differs : from 1308697239 to 1308697249</div><div>Jun 22 11:00:49 opendnssec ods-auditor[23029]: Auditing spam.co.nz zone : NSEC3 SIGNED</div><div>Jun 22 11:00:50 opendnssec ods-auditor[23029]: Finished auditing spam.co.nz zone</div></div><div><br></div><div>It will sign ok.. And run <NotifyCommand>/archives/reloadnamed.pl</NotifyCommand> ok</div><div><br></div><div>But the KSK is not active..</div><div><br></div><div><div>ods-ksmutil key list</div><div>SQLite database set to: /var/lib/opendnssec/db/kasp.db</div><div>Keys:</div><div>Zone: Keytype: State: Date of next transition:</div><div>spam.co.nz KSK publish 2011-06-23 00:58:28 </div><div>spam.co.nz ZSK active 2011-07-22 10:58:28</div></div><div><br></div><div>So no DS's show..</div><div><div><br></div><div>ods-ksmutil key export --zone spam.co.nz --ds</div><div>SQLite database set to: /var/lib/opendnssec/db/kasp.db</div></div><div><br></div><div><div>ods-ksmutil key list --verbose</div><div>SQLite database set to: /var/lib/opendnssec/db/kasp.db</div><div>Keys:</div><div>Zone: Keytype: State: Date of next transition: CKA_ID: Repository: Keytag:</div><div>spam.co.nz KSK publish 2011-06-23 00:58:28 8e27b9f2560825f70d8640017e091b06 SoftHSM 54437</div><div>spam.co.nz ZSK active 2011-07-22 10:58:28 0fbf4ec5ea8b25e772196946e46af700 SoftHSM 8839</div></div><div><br></div><div><br></div><div>When running ksm-enforcer –1</div><div><br></div><div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: opendnssec starting...</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: opendnssec Parent exiting...</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: opendnssec forked OK...</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: group set to: opendnsec (0)</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: user set to: opendnsec (0)</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: opendnssec started (version 1.2.1), pid 23063</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: HSM opened successfully.</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Reading config "/etc/opendnssec/conf.xml"</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Reading config schema "/usr/share/opendnssec/conf.rng"</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Communication Interval: 3600</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: No DS Submit command supplied</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: SQLite database set to: /var/lib/opendnssec/db/kasp.db</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Log User set to: local0</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Switched log facility to: local0</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Connecting to Database...</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Policy default found.</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Key sharing is Off.</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Purging keys...</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: zonelist filename set to /etc/opendnssec/zonelist.xml.</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Zone spam.co.nz found.</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Policy for spam.co.nz set to default.</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Config will be output to /var/lib/opendnssec/signconf/spam.co.nz.xml.</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: WARNING: KSK rollover for zone 'spam.co.nz' not completed as there are no keys in the 'ready' state; ods-enforcerd will try again when it runs next</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: No change to: /var/lib/opendnssec/signconf/spam.co.nz.xml</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Disconnecting from Database...</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: Running once only, exiting...</div><div>Jun 22 11:13:48 opendnssec ods-enforcerd: all done! hsm_close result: 0</div></div><div><br></div><div><br></div><div>Thanks</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></body></html>