<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: 宋体; COLOR: #000080; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>Hi all,</DIV>
<DIV> </DIV>
<DIV>Thanks for your replay.</DIV>
<DIV>I have written some scrpits to compare the signed file with the raw one,
</DIV>
<DIV>only if the counts of all kinds of RRs and RRSIGs match will it be
supposed</DIV>
<DIV>to be valid and intact.</DIV>
<DIV> </DIV>
<DIV>
<DIV>>And I would also be interested in the the failed zone file, signed and</DIV>
<DIV>>unsigned</DIV>
<DIV>Sorry to delete the unsigned one because it would be overwritten every
15min,</DIV>
<DIV>but I have noticed that the incomplete signed one lacks NSEC3 RRs and
RRSIGs </DIV>
<DIV>except for SOA and DNSKEY and NSEC3PARAM.</DIV>
<DIV> </DIV>
<DIV>
<DIV>> Are you using the <NotifyCommand> mechanism for this? This is the</DIV>
<DIV>> best way to determine when the signing is complete.</DIV>
<DIV>No, I'm not. Because the signer server and the hidden master may be not
the</DIV>
<DIV>same server(both signer server and hidden master need large amount of
memory </DIV>
<DIV>which may lead to high memory consumption), so I have to scp the signed
file </DIV>
<DIV>to hidden master which OpenDNSSEC would not do.</DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV>Stuart</DIV></DIV>
<DIV> </DIV></DIV>
<DIV>
<DIV><SPAN></SPAN></DIV></DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0cm; PADDING-LEFT: 0cm; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<DIV
style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; COLOR: #000000; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV><B>From:</B> <A href="mailto:matthijs@nlnetlabs.nl">Matthijs
Mekking</A></DIV>
<DIV><B>Date:</B> 2012-09-12 19:05</DIV>
<DIV><B>To:</B> <A href="mailto:sara@sinodun.com">Sara Dickinson</A></DIV>
<DIV><B>CC:</B> <A href="mailto:shuoleo@126.com">shuoleo</A>; <A
href="mailto:opendnssec-user@lists.opendnssec.org">opendnssec-user</A></DIV>
<DIV><B>Subject:</B> Re: [Opendnssec-user]How to determin when signing zone
work ends</DIV></DIV></DIV>
<DIV>
<DIV>-----BEGIN PGP SIGNED MESSAGE-----</DIV>
<DIV>Hash: SHA1</DIV>
<DIV> </DIV>
<DIV>On 09/12/2012 11:53 AM, Sara Dickinson wrote:</DIV>
<DIV>> On 11 Sep 2012, at 07:08, wfXLtg== wrote:</DIV>
<DIV>> </DIV>
<DIV>>> Hi Matthijs,</DIV>
<DIV>>> </DIV>
<DIV>>> I'm now using Adapter File which is more stable than Adapter</DIV>
<DIV>>> DNS. The work flow is as follows: 1.generate zone files from db</DIV>
<DIV>>> and saved in ./unsigned/ 2.when all the zone files are ready, run</DIV>
<DIV>>> ods-signer sign --all 3.monitor whether there are signed zones in</DIV>
<DIV>>> ./signed/ and scp immediately signed zone from ./signed to hidden</DIV>
<DIV>>> master BIND , after transfer completeed using "rndc reload"</DIV>
<DIV>> </DIV>
<DIV>> Are you using the <NotifyCommand> mechanism for this? This is the</DIV>
<DIV>> best way to determine when the signing is complete.</DIV>
<DIV> </DIV>
<DIV>I agree with Sara, replace the monitoring with the NotifyCommand.</DIV>
<DIV> </DIV>
<DIV>> </DIV>
<DIV>>> to make BIND reload the newly signed zone file 4.test whether </DIV>
<DIV>>> 4.do the above steps every 15 mins</DIV>
<DIV>>> </DIV>
<DIV>>> The problem is sometimes the zone files in the ./singed/ may be</DIV>
<DIV>>> not signed by ods-signer sign --all, it may be signed by</DIV>
<DIV>>> automatic resign, so sometimes the RRs in the zones are not the</DIV>
<DIV>>> exact ones in db. So as you suggested, I have changed the resign</DIV>
<DIV>>> value to a relatively large number but I find that I have to</DIV>
<DIV>>> changed refresh, validity/default,validity/denial, too, so I can</DIV>
<DIV>>> not set the resign period to 1Y for example, because refresh </DIV>
<DIV>>> should be larger than resign and validity/default and</DIV>
<DIV>>> validity/denial should be larger than refresh. I think the</DIV>
<DIV>>> validity is 30D which is commonly used by registries, so can you</DIV>
<DIV>>> recommend other values?</DIV>
<DIV> </DIV>
<DIV>Well, 1Y was perhaps a bit of an exaggerating example. But if you will</DIV>
<DIV>call ods-signer sign --all every 15 minutes, you probably are more</DIV>
<DIV>than safe with a resign value of a day.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>>> </DIV>
<DIV>>> And I knew that if a zone is not signed compeltely, ods-signerd</DIV>
<DIV>>> will only create a <zone>.tmp file in ./signed/, but in my test I</DIV>
<DIV>>> have found that a zone has been scped to the hidden master with</DIV>
<DIV>>> less size than its supposed size, and its file name is test not</DIV>
<DIV>>> test.tmp, so my program is sure that it's signed completely and</DIV>
<DIV>>> transfer it to the destination. Is there a possibility that </DIV>
<DIV>>> ods-signerd signs zone file not completely and make <zone>.tmp to</DIV>
<DIV>>> <zone>? If not, I can hardly understand why the signed file is</DIV>
<DIV>>> more less than the unsigned one.</DIV>
<DIV> </DIV>
<DIV>If the signer completely have written out the signed zone file to</DIV>
<DIV><signed-zonefilename>.tmp, it will rename it to <signed-zonefilename>.</DIV>
<DIV> </DIV>
<DIV>> </DIV>
<DIV>> Perhaps you can send us your xml files and log files offlist?</DIV>
<DIV> </DIV>
<DIV>And I would also be interested in the the failed zone file, signed and</DIV>
<DIV>unsigned.</DIV>
<DIV> </DIV>
<DIV>> </DIV>
<DIV>> Thanks</DIV>
<DIV>> </DIV>
<DIV>> Sara.</DIV>
<DIV>> </DIV>
<DIV>>> </DIV>
<DIV>>> Best regards, Stuart </DIV>
<DIV>>> _______________________________________________ Opendnssec-user</DIV>
<DIV>>> mailing list Opendnssec-user@lists.opendnssec.org </DIV>
<DIV>>> <mailto:Opendnssec-user@lists.opendnssec.org> </DIV>
<DIV>>> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</DIV>
<DIV>> </DIV>
<DIV> </DIV>
<DIV>-----BEGIN PGP SIGNATURE-----</DIV>
<DIV>Version: GnuPG v1.4.11 (GNU/Linux)</DIV>
<DIV>Comment: Using GnuPG with Mozilla - http://www.enigmail.net/</DIV>
<DIV> </DIV>
<DIV>iQEcBAEBAgAGBQJQUGx2AAoJEA8yVCPsQCW5AOQIAKVmTf8uKA/Nao3chNFkhBSQ</DIV>
<DIV>1IyIAnQCleSCADZT1Zhlp6GUqljKqGW+0AxHzCWa5jg3EYI4gQeiO5PctKV65j9A</DIV>
<DIV>Ns609V5XT/pSa78viZ2X8oyPYLyyJMy3arGGJWa4itbZWPpd7kuGRZ3GytNqiTrY</DIV>
<DIV>x8o+46rmj3oBv9Mh41MW+yNsObD68Wk7HdM7RttnOYeY8J6V9g0NuoXkNo6+mDkZ</DIV>
<DIV>yu3vVR+YrsIJcthKi9i8WnIt1dZKddEEfl7AKIGCl8UMteLfUVXOnEd7Z+byuZ/j</DIV>
<DIV>Ry5UlgdUXFPTjCsfBk200X8AwQr1IBYCne5TIxQnXEmKjOrZJKK+I/FWS6Vk3Sk=</DIV>
<DIV>=wnul</DIV>
<DIV>-----END PGP SIGNATURE-----</DIV></DIV></BODY></HTML>