<div dir="ltr"><div><div><div><div><div><div><div>Hello-<br><br></div>I'm sorry for a dumb question (I've just started working with OpenDNSSEC), but in the following setup with three servers involved:<br><br></div>
[Hidden master] <---> [OpenDNSSEC] <---> [Public slave]<br><br></div>do I need to run "traditional" DNS server on the OpenDNSSEC box to deal with signed zones transfers to the slave?<br><br></div>I think I have a problem with getting the zone from the hidden master as soon as I increase the serial.<br>
<br></div>All three servers are running FreeBSD 10-STABLE, with the latest NSD (4.0.3) installed on the hidden master and the slave. OpenDNSSEC box (version 1.4.6) doesn't have NSD installed.<br><br></div>My plan is to feed plain zones to OpenDNSSEC, sign them and transfer to the slave.<br>
<br></div>Here is the snippet from nsd.conf from the hidden master (192.168.157.47 is the IP of OpenDNSSEC):<br><br>pattern:<br> name: "plain-to-signer"<br> zonefile: "zones/%s"<br> notify: 192.168.157.47 tsig.sha256.signed<br>
provide-xfr: 192.168.157.47 tsig.sha256.signed<br><br>zone:<br> name: "<a href="http://domain.org">domain.org</a>"<br> include-pattern: "plain-to-signer"<br><div><div><br></div><div>
OpenDNSSEC configs:<br><br></div><div>addns.xml (192.168.157.46 is the hidden master and 192.168.163.86 is the slave):<br><br><Inbound><br><RequestTransfer><br><Remote><br><Address>192.168.157.46</Address><br>
<Key>tsig.sha256.signed</Key><br></Remote><br></RequestTransfer><br><br><AllowNotify><br><Peer><br><Prefix>192.168.157.46</Prefix><br><Key>tsig.sha256.signed</Key><br>
</Peer><br></AllowNotify><br></Inbound><br><br><Outbound><br><ProvideTransfer><br><Peer><br><Prefix>192.168.163.86</Prefix><br><Key>tsig.sha256.signed</Key><br></Peer><br>
</ProvideTransfer><br><br><Notify><br><Remote><br><Address>192.168.163.86</Address><br><Key>tsig.sha256.signed</Key><br></Remote><br></Notify><br></Outbound><br>
<br></div><div>conf.xml is the default one, with one modification:<br><br><Listener><br><Interface><Address>192.168.157.47</Address><Port>53</Port></Interface><br></Listener><br>
<br></div><div>kasp.xml is the default one (I'm using default policy), with one change:<br><br><Serial>datecounter</Serial><br><br></div><div>zonelist.xml:<br><br><Zone name="<a href="http://domain.org">domain.org</a>"><br>
<Policy>default</Policy><br><SignerConfiguration>/usr/local/var/opendnssec/signconf/domain.org.xml</SignerConfiguration><br><Adapters><br><Input><br><Adapter type="DNS">/usr/local/etc/opendnssec/addns.xml</Adapter><br>
</Input><br><Output><br><Adapter type="DNS">/usr/local/etc/opendnssec/addns.xml</Adapter><br></Output><br></Adapters><br></Zone><br><br></div><div>If I increase the serial, reload the zone on hidden master and do ods-control stop/start on the OpenDNSSEC I see that the signed zone was successfully transferred to the slave. Here is the log from the slave:<br>
<br>[1408994435] nsd[1404]: info: notify for <a href="http://domain.org">domain.org</a>. from 192.168.157.47<br>[1408994435] nsd[1364]: info: xfrd: zone <a href="http://domain.org">domain.org</a> committed "received update to serial 2014082512 at 2014-08-25T21:20:35 from 192.168.157.47 TSIG verified with key tsig.sha256.signed"<br>
[1408994435] nsd[1480]: info: rehash of zone <a href="http://domain.org">domain.org</a>. with parameters 1 0 5 e99189ffbae225cf<br>[1408994435] nsd[1480]: info: zone <a href="http://domain.org">domain.org</a>. received update to serial 2014082512 at 2014-08-25T21:20:35 from 192.168.157.47 TSIG verified with key tsig.sha256.signed of 3566 bytes in 0.000139 seconds<br>
[1408994435] nsd[1364]: info: Zone <a href="http://domain.org">domain.org</a> serial 2014082509 is updated to 2014082512. <br><br></div><div>But if I just increase the serial and reload the zone on hidden master, I get the following in the logs of OpenDNSSEC:<br>
<br>Aug 26 09:20:40 ns-sign ods-signerd: [xfrd] zone <a href="http://domain.org">domain.org</a> request udp/ixfr=2014082511 to 192.168.157.46<br><br></div><div>and nothing happens after that. I see no errors on the hidden master or OpenDNSSEC.<br>
<br></div><div>Any hints would be greatly appreciated.<br><br></div><div>Thank you.<br></div></div></div>