<div dir="ltr">Hi,<div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Jun 26, 2014 at 12:44 PM, Ville Mattila <span dir="ltr"><<a href="mailto:vmattila@csc.fi" target="_blank">vmattila@csc.fi</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hi,<br>
<div class=""><br>
On 2014-06-26 11:13, Emil Natan wrote:<br>
<br>
> On Thu, Jun 26, 2014 at 10:45 AM, Klaus Darilion<br>
</div>> <<a href="mailto:klaus.mailinglists@pernau.at">klaus.mailinglists@pernau.at</a> <mailto:<a href="mailto:klaus.mailinglists@pernau.at">klaus.mailinglists@pernau.at</a>>> wrote:<br>
<div class="">><br>
><br>
><br>
> On <a href="tel:25.06.2014%2015" value="+12506201415">25.06.2014 15</a> <tel:25.06.2014%2015>:13, Emil Natan wrote:<br>
> > Hello,<br>
> ><br>
> > My goal is to replicate the ODS configuration between two nodes,<br>
> one is<br>
> > active with ODS running and one passive where ODS is not running.<br>
> ><br>
> > <a href="https://wiki.opendnssec.org/display/DOCS/High+availability" target="_blank">https://wiki.opendnssec.org/display/DOCS/High+availability</a><br>
> ><br>
> > ... states under the "What to copy" section:<br>
> ><br>
> > "The state data - the minimum data required are the signconf files<br>
> > (default location is the /var/opendnssec/signconf directory)"<br>
> ><br>
> > I see the files under signconf actually contain configuration copied<br>
> > from kasp.conf and information about the keys which is stored in the<br>
> > database (in my case MySQL). If missing these files, they are<br>
> > automatically created when the enforcer starts. My point is I do<br>
> not see<br>
> > a reason to copy these files from one machine to another if they are<br>
> > created when the enforcer starts. Can I really omit this step or I'm<br>
> > missing something?<br>
><br>
> How will the enforcer on the backup server know which are the currently<br>
> used keys? E.g. how many key rollovers were done meanwhile?<br>
><br>
> I'm not sure I got your point. Information about the keys is stored in<br>
> the database which is replicated on the backup server. When the enforcer<br>
> is started it reads that information and it's configuration files and<br>
> creates the signconf xml files used by the signer including pointers to<br>
> the keys currently used for signing. Am I missing something?<br>
<br>
</div>(I think your description is correct and you are not missing anything;<br>
our HA design is based on this idea and I would be very interested to<br>
know if it's wrong..)<br>
<div class=""><br>
> We have the signer running on both servers, but the enforcer only runs<br>
> on the main server. And the output files of the enforcer are rsynced to<br>
> the backup server. When the backup becomes the master, we start the<br>
> enforcer on the backup server and switch the rsync direction.<br>
><br>
> I'm considering that scenario as well. The problem which I have to<br>
> resolve is when to rsync the xml-s created by the enforcer. Using a<br>
> cronjob to run rsync at some intervals is not ideal because it can<br>
> create a gap when the files are changed and something happens with the<br>
> active server before the rsync is invoked. Another option is to use a<br>
> shared storage as DRBD, but my experience with DRBD is not so positive.<br>
> Now I'm considering to use Inotify to trigger the rsync. Can you please<br>
> share how are you managing the rsync process, I mean how/when do you<br>
> trigger the process?<br>
<br>
</div>Signer writes the signed zone to a file and runs NotifyCommand[1] script<br>
which runs rsync (and validns and ldns-verify-zone) before it pushes the<br>
signed zone to the DNS servers. Though I'm not sure if you can use<br>
NotifyCommand with DNS output adapters.<br>
<br>
[1]<br>
<a href="https://wiki.opendnssec.org/display/DOCS/conf.xml#conf.xml-SignerConfiguration" target="_blank">https://wiki.opendnssec.org/display/DOCS/conf.xml#conf.xml-SignerConfiguration</a><br>
<br>
You could also run 'ods-enforcerd -1' e.g. once a week instead of<br>
letting ods-enforcerd run continuosly as daemon:<br>
1. Shut down ods-signerd.<br>
2. Run 'ods-enforcerd -1' on primary server to let it update KASP<br>
database and signconf files.<br>
3. Synchronize KASP db (and signconfs if you wish) from primary to<br>
standby OpenDNSSEC servers.<br>
4. Start up ods-signerd again.<br>
Shutting down ods-signerd temporarily is to make sure the standby<br>
servers have the exact same KASP/signconf info which the signer daemon<br>
on the primary server is going to be using next. (Of course it's<br>
equally important to make sure there is not too much delay or drops in<br>
the propagation of signed zone data from OpenDNSSEC to all DNS servers<br>
of the zone, because currently there is no way to give feedback to<br>
enforcer about when the key rollover updates actually made it into DNS.)<br>
<br>
Thanks,<br>
<span class=""><font color="#888888">--<br>
Ville Mattila, CSC<br>
<br>
</font></span><br></blockquote><div>Ok, so you actually rely on the signer invocation to trigger the rsync via the NotifyCommand and the process includes a single run of the enforcer. That's all fine, but it still can leave a gap between the data on the active server and what you have on the stand-by servers if the enforcer is invoked (manually or automatically each <Interval>) and changes are introduced until the signer is invoked again. I do not know how often the signer runs in your scenario, but theoretically your servers can run out of sync. As far as I understand in the ideal scenario the rsync should be run after each run of the enforcer, but the enforcer functionality lacks such "NotifyCommand" feature.</div>
<div>Thank you very much for sharing the above information.</div><div><br></div><div>Emil</div></div></div></div>