<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=UTF-8" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em; MARGIN-TOP: 0px
}
OL {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
UL {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
P {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
DIV.FoxDiv20140825101228512977 {
FONT-SIZE: 10.5pt; FONT-FAMILY: 宋体; COLOR: #000000; LINE-HEIGHT: 1.5
}
BODY {
FONT-SIZE: 10.5pt; FONT-FAMILY: 宋体; COLOR: #000000; LINE-HEIGHT: 1.5
}
</STYLE>
<META name=GENERATOR content="MSHTML 11.00.9600.17239"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>
<DIV>Hi,Emil</DIV>
<DIV> </DIV>
<DIV style="TEXT-INDENT: 2em">From the previous thread discussion in <A
href="http://lists.opendnssec.org/pipermail/opendnssec-user/2014-June/003024.html">http://lists.opendnssec.org/pipermail/opendnssec-user/2014-June/003024.html</A> ,
I notice the idea is like this :</DIV>
<DIV style="TEXT-INDENT: 2em">1. the master runs enforcer and signer </DIV>
<DIV style="TEXT-INDENT: 2em">2. the slave runs signer only</DIV>
<DIV style="TEXT-INDENT: 2em">3. sync conf files from master to slave</DIV>
<DIV style="TEXT-INDENT: 2em">4. if master is down , run enforcer on slave
immediately</DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV>
<DIV style="TEXT-INDENT: 2em">
<DIV style="TEXT-INDENT: 2em">We plan to do like this :</DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV>
<DIV style="TEXT-INDENT: 2em">1.Two opendnssec instances employed</DIV>
<DIV style="TEXT-INDENT: 2em">2.The same HSM cluster serves for keys
production</DIV>
<DIV style="TEXT-INDENT: 2em">3.The same Mysql cluster serves for key data
storage</DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV></DIV>
<DIV style="TEXT-INDENT: 2em">I wonder if enforcer runs on both nodes,what will
happen ? Does the enforcer on slave have to be stopped?</DIV>
<DIV style="TEXT-INDENT: 2em"><BR> </DIV></DIV>
<DIV> </DIV>
<DIV> </DIV>
<HR style="HEIGHT: 1px; WIDTH: 210px" align=left color=#b5c4df SIZE=1>
<DIV>2014-08-25 10:12:28</DIV>
<DIV>gaolei</DIV>
<DIV
style="BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; BORDER-BOTTOM: medium none; PADDING-BOTTOM: 0cm; PADDING-TOP: 3pt; PADDING-LEFT: 0cm; BORDER-LEFT: medium none; PADDING-RIGHT: 0cm">
<DIV
style="FONT-SIZE: 12px; FONT-FAMILY: tahoma; BACKGROUND: #efefef; COLOR: #000000; PADDING-BOTTOM: 8px; PADDING-TOP: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px">
<DIV><B>From:</B> <A href="mailto:shlyoko@gmail.com">Emil Natan</A></DIV>
<DIV><B>Date:</B> 2014-08-24 21:20</DIV>
<DIV><B>To:</B> <A href="mailto:gaolei@knet.cn">gaolei</A></DIV>
<DIV><B>CC:</B> <A
href="mailto:opendnssec-user@lists.opendnssec.org">opendnssec-user</A></DIV>
<DIV><B>Subject:</B> Re: [Opendnssec-user] About High Availablity for
OpenDNSSEC</DIV></DIV></DIV>
<DIV>
<DIV class=FoxDiv20140825101228512977 style="BACKGROUND-COLOR: white">
<DIV dir=ltr>Hi,
<DIV class=gmail_extra><BR><BR>
<DIV class=gmail_quote>On Sun, Aug 24, 2014 at 3:59 PM, gaolei <SPAN
dir=ltr><<A href="mailto:gaolei@knet.cn"
target=_blank>gaolei@knet.cn</A>></SPAN> wrote:<BR>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid"><U></U>
<DIV style="MARGIN: 10px">
<DIV>
<DIV> </DIV></DIV>
<DIV>
<DIV style="BACKGROUND-COLOR: white">
<DIV>
<DIV>
<DIV><FONT face=Verdana>Hi all,</FONT></DIV>
<DIV> </DIV>
<DIV style="TEXT-INDENT: 2em">From KNET , I notice there is a topic about
opendnssec High Availablity at <A
href="https://wiki.opendnssec.org/display/DOCS/High+availability"
target=_blank>https://wiki.opendnssec.org/display/DOCS/High+availability</A>
</DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV>
<DIV style="TEXT-INDENT: 2em">But I was a little puzzled by this page.</DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV>
<DIV style="TEXT-INDENT: 2em">It mentioned about master/slave like
this:</DIV>
<DIV style="TEXT-INDENT: 2em">
<H2
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(255,126,0); PADDING-BOTTOM: 0px; BORDER-BOTTOM-COLOR: rgb(102,153,204); PADDING-TOP: 0px; FONT: 20px/1.5 Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 30px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px">Master/Slave</H2>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px"><FONT
color=#ff9900>Careful consideration should be given to which, if any, process
are run on a slave (or on each master in a Master-Master) configuration. Some
operators don't run either the enforcer or the signer on a slave instance but
merely duplicate the data between the two instances in a timely fashion.
Others run two master servers, both enforcing and signing but only publishing
from an 'active' master</FONT>.</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px"> </P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">I'm
wondering what will happen to the rollover of keys if we make a
master-master deployment.</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">1.Mysql
used to store keys data , and</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">2.HSM
machine employed to generate keys , and</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">3.Two
opendnssec instances running on seperate servers for the same zone</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">Will
the two opendnssec instances generate different keys for the same zone? If so
, it seems as if it will bring troubles when the 'active' master is
down ?</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em"></P></DIV></DIV></DIV></DIV></DIV></DIV></BLOCKQUOTE>
<DIV><BR></DIV>
<DIV>Yes, the two instances will generate different keys and that will cause
problems on switching between the two signers. It's not clear if you plan to use
separate HSM for each of the ODS instances, but what you generally do is
pre-generate keys and have them synced in case of two HSMs. The MySQL on both
signers should be in sync, the HSM key mapping files as well so basically the
two signers sign the zone using the same keys.</DIV>
<DIV>Here is another thread of the mailing list discussing HA.</DIV>
<DIV><A
href="http://lists.opendnssec.org/pipermail/opendnssec-user/2014-June/003024.html">http://lists.opendnssec.org/pipermail/opendnssec-user/2014-June/003024.html</A><BR></DIV>
<DIV><BR></DIV>
<DIV>HTH</DIV>
<DIV><BR></DIV>
<DIV>Emil</DIV>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV style="MARGIN: 10px">
<DIV>
<DIV style="BACKGROUND-COLOR: white">
<DIV>
<DIV>
<DIV style="TEXT-INDENT: 2em">
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em"> </P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">Can anyone
give more suggestions on the High Availablity of opendnssec ?</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em"> </P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">Best
Regards!</P></DIV></DIV></DIV>
<DIV> </DIV>
<HR style="WIDTH: 210px; MIN-HEIGHT: 1px" align=left color=#b5c4df SIZE=1>
<DIV>2014-08-24 18:05:37</DIV><SPAN><FONT color=#888888>
<DIV>gaolei</DIV></FONT></SPAN></DIV></DIV></DIV><BR>_______________________________________________<BR>Opendnssec-user
mailing list<BR><A
href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</A><BR><A
href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user"
target=_blank>https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</A><BR><BR></BLOCKQUOTE></DIV><BR></DIV></DIV></DIV></DIV></BODY></HTML>