Hello,<div><br></div><div>I think I am close to getting them working but when I do +dnssec queries, I still get nothing. After these steps, I'm getting the following errors:</div><div><br></div><div><div>Mar 8 15:05:18 ubuntu ods-auditor[13338]: <a href="http://example.com">example.com</a> : SOA differs : from 2012030506 to 2012030800</div>
</div><div>---- I have datecounter as my serial.... if I change this to 2012030800 or whatever the current date is, will this synch up?</div><div><br></div><div><div>rndc: could not load rndc configuration</div><div>rndc: error: none:0: open: /etc/bind/rndc.key: permission denied</div>
</div><div>---- this periodically spams my screen... what is going on with these errors? what permissions does this .key file need...?</div><div><br></div><div>I kind of followed the guide/instructions located as part of the DNSSEC workshop...specifically this file:</div>
<div><br></div><div><a href="https://nsrc.org/workshops/2011/dakar-dnssec/raw-attachment/wiki/Agenda/opendnssec-howoto.txt">https://nsrc.org/workshops/2011/dakar-dnssec/raw-attachment/wiki/Agenda/opendnssec-howoto.txt</a></div>
<div><br></div><div>STEPS TAKEN TO SETUP OPENDNSSEC:</div><div><br></div><div>At this point zone in /unsigned gets signed and move to /tmp and /signconf files are also generated. The zone is signed in /signed but still unable to fill +dnssec queries. <br>
</div><div><br></div><div><br></div><div><div>Add ppa repository</div><div>sudo add-apt-repository ppa:pkg-opendnssec/ppa</div><div>sudo apt-get update</div><div>Ubuntu Software center:</div><div>Sudo apt-get install libldns1</div>
<div>Sudo apt-get install rubygems</div><div>Sudo apt-get install dnsruby</div><div>Sudo apt-get install ruby-dev</div><div>Sudo apt-get install libopenssl-ruby</div><div>Sudo apt-get install sqlite3</div><div>Sudo apt-get install Libsqlite3-dev</div>
<div>Sudo apt-get install opendnssec</div><div>-------------------------------------------------</div><div>SoftHSM is a implementation of a cryptographic store accessible through PKCS#11</div><div>Basically it virtualizes having a ‘smart card’ in order to save on time/money and allows you to use this virtualized smart card to sign zones. So we install and then initialize a token.</div>
<div><br></div><div>Sudo apt-get install libbotan-1.10-0</div><div>Sudo apt-get install softhsm</div><div><br></div><div>Sudo chmod –R 755 /etc/softhsm</div><div>Sudo chmod –R 755 /var/lib/softhsm</div><div>softhsm --init-token --slot 0 --label OpenDNSSEC</div>
<div>Pw=1234, pw=1234</div><div>-------------------------------------------------</div><div>Sudo chmod –R 755 opendnssec</div><div>Sudo nano /etc/opendnssec/kasp.xml</div><div>Comment out <NSEC3>---through---</NSEC3></div>
<div>Add <NSEC></NSEC> below it</div><div>Go down to <zone> section, change unixtime datecounter</div><div>NOTE: had issues with the serial/time several times, not sure if I ever got this fixed but this was the solution told</div>
<div>Sudo nano /etc/opendnssec/conf.xml</div><div>Remove comments surrounding the first respository - softHSM</div><div>NOTE: tokenlabel value must match what was previously used when initializing the token (Ex: OpenDNSSEC)</div>
<div>-------------------------------------------------</div><div>Ods-ksmutil setup</div><div>Y at the warning</div><div>Sudo nano /etc/bind/named.conf.local</div><div>In zone <a href="http://example.com">example.com</a> add:</div>
<div>Allow-transfer { 127.0.0.1;};</div><div>Sudo rndc reconfig</div><div>Sudo chmod 755 /var/lib/opendnssec</div><div>Copy your unsigned zone file into the unsigned folder</div><div>EX: “Sudo cp /etc/bind/zones/<a href="http://example.com">example.com</a> /var/lib/opendnssec/unsigned”</div>
<div>NOTE: This zone file should not contain any BIND DNSSEC info…keys…etc</div><div>sudo ods-ksmutil zone add --zone <a href="http://example.com">example.com</a></div><div>-------------------------------------------------</div>
<div>Sudo nano /etc/opendnssec/conf.xml</div><div>Remove comment lines surrounding:</div><div>“<NotifyCommand>/usr/sbin/rndc reload %zone</NotifyCommand>”</div><div>Remove comment lines surrounding:</div><div>
<Privileges></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><User>opendnssec</User></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><Group>opendnssec</Group></div>
<div></Privileges></div><div>Cd /etc</div><div>Sudo chown –R opendnssec:opendnssec opendnssec</div><div>Cd /var/lib</div><div>Sudo chown –R opendnssec:opendnssec opendnssec</div><div>cd /etc</div><div>Sudo chmod –R 777 softhsm</div>
<div><br></div><div>-------------------------------------------------</div><div>Sudo adduser opendnssec softhsm</div><div>Sudo chown -R opendnssec /var/lib/softhsm/</div><div>Sudo nano /etc/bind/named.conf.options</div><div>
Add “dnssec-enable yes;” in the options</div><div>Restart bind</div><div>Sudo ods-ksmutil setup</div><div>Sudo ods-control start</div><div>Sudo ods-sign sign <a href="http://example.com">example.com</a></div><div><br></div>
<div>NOTE: At this point zone in /unsigned gets signed and move to /tmp and /signconf files are also generated. The zone is signed in /signed but still unable to fill +dnssec queries.</div></div>