<div dir="ltr">Hi,<div><br></div><div>I do not have experience with Thales HSM (probably the only one I did not tested). With the HSM I'm currently using, it's the provider (the library provided by the manufacturer) that knows to look for the "HSM" record in /etc/hosts and resolve the IP address. Of course you can try "ods-hsmutil list" and use sniffer to check if the signer machine tries to connect to the HSM.</div>
<div><br></div><div>Emil</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Apr 21, 2014 at 4:43 PM, Mark Elkins <span dir="ltr"><<a href="mailto:mje@posix.co.za" target="_blank">mje@posix.co.za</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I'm wondering around in the dark....<br>
<br>
Config is OpenDNSSEC 1.4.3, Thales HSM and MySQL on Gentoo (up to date)<br>
<br>
Environment includes..<br>
<br>
export CKNFAST_LOADSHARING=1<br>
export PKCS11_NCIPHER=/opt/nfast/toolkits/pkcs11/libcknfast.so<br>
<br>
Admin and SoftKey have been generated on the HSM (story in itself)...<br>
---------------------<br>
# ppmk --new --non-recoverable OpenDNSSEC<br>
<br>
FIPS: insert OCS/ACS:<br>
Module 1: 0 cards read<br>
Module 1 slot 0: empty<br>
(rushed over to the HSM and stuck in an Admin card)<br>
Card reading<br>
complete.<br>
<br>
Enter new pass phrase: *mysecret*<br>
Enter new pass phrase again:<br>
New softcard created: HKLTU 8e1ae6104442f2a568c4fcf0b747b9ad112d7275<br>
<br>
(The above will only work once a "Security World" is created - so I<br>
believe that's OK)<br>
<br>
---------------------<br>
Configs have been updates (DB=Mysql, HSM=Thales)<br>
<br>
> <Repository name="thales"><br>
> <Module>/opt/nfast/toolkits/pkcs11/libcknfast.so</Module><br>
> <TokenLabel>OpenDNSSEC</TokenLabel><br>
> <PIN>TheSameSecret</PIN><br>
> <Capacity>255</Capacity><br>
> </Repository><br>
<br>
<br>
OpenDNSSEC compiled clean...<br>
<br>
ods-ksmutil setup: appears to have run just fine.<br>
I have three zones in the system.<br>
<br>
Problem:<br>
ods-enforcerd started (version 1.4.3), pid 14122<br>
Could not start enforcer<br>
<br>
Tail of Log says:<br>
pr 21 15:12:15 vhost2 ods-enforcerd: 3 zone(s) found on policy "nsec3"<br>
Apr 21 15:12:15 vhost2 ods-enforcerd: 3 new KSK(s) (2048 bits) need to<br>
be created.<br>
Apr 21 15:12:15 vhost2 ods-enforcerd: Error creating key in repository<br>
thales<br>
Apr 21 15:12:15 vhost2 ods-enforcerd: generate key pair: Unknown error<br>
<br>
<br>
Where do I start and debug this?<br>
<br>
I really don't know if the HSM and OpenDNSSEC are talking together. I've<br>
seen no place where I tell OpenDNSSEC the IP address of the HSM. I can<br>
talk to the HSM using thales supplied software, which always needs an IP<br>
address. The OpenDNSSEC docs don't seem to have an HSP IP address.<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Mark James ELKINS - Posix Systems - (South) Africa<br>
<a href="mailto:mje@posix.co.za">mje@posix.co.za</a> Tel: <a href="tel:%2B27.128070590" value="+27128070590">+27.128070590</a> Cell: <a href="tel:%2B27.826010496" value="+27826010496">+27.826010496</a><br>
For fast, reliable, low cost Internet in ZA: <a href="https://ftth.posix.co.za" target="_blank">https://ftth.posix.co.za</a><br>
</font></span><br>_______________________________________________<br>
Opendnssec-user mailing list<br>
<a href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a><br>
<a href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user" target="_blank">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a><br>
<br></blockquote></div><br></div>