<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=UTF-8" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em; MARGIN-TOP: 0px
}
OL {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
UL {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
P {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
DIV.FoxDiv20140916161044512889 {
FONT-SIZE: 10.5pt; FONT-FAMILY: 宋体; COLOR: #000000; LINE-HEIGHT: 1.5
}
BODY {
FONT-SIZE: 10.5pt; FONT-FAMILY: 宋体; COLOR: #000000; LINE-HEIGHT: 1.5
}
</STYLE>
<META name=GENERATOR content="MSHTML 11.00.9600.17280"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>
<DIV>Hi, all</DIV>
<DIV style="TEXT-INDENT: 2em">On the HA of opendnssec , I committed a test like
this:</DIV>
<DIV style="TEXT-INDENT: 2em">1. Enforcer and Signer were running on serverA to
serve as master opendnssec</DIV>
<DIV style="TEXT-INDENT: 2em">2. Another Singer was running on serverB to
serve as slave opendnssec</DIV>
<DIV style="TEXT-INDENT: 2em">3. Outbind BIND serverC took serverA and
B both as master BIND.</DIV>
<DIV> </DIV>
<DIV>
<DIV>
INBIND</DIV>
<DIV style="TEXT-INDENT: 12em">
/ \</DIV>
<DIV style="TEXT-INDENT: 12em">
/ \</DIV>
<DIV
style="TEXT-INDENT: 10em">serverA
serverB</DIV>
<DIV style="TEXT-INDENT: 8em">opendnssec
master opendnssec
slave </DIV>
<DIV
style="TEXT-INDENT: 2em">
\ /</DIV>
<DIV
style="TEXT-INDENT: 2em">
\ /</DIV>
<DIV
style="TEXT-INDENT: 2em">
OUTBIND</DIV>
<DIV style="TEXT-INDENT: 16em">serverC</DIV></DIV>
<DIV> </DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV>
<DIV style="TEXT-INDENT: 2em">I found when i shutdown server A, dns update
cannot transfer from serverB to outbind serverC.</DIV>
<DIV style="TEXT-INDENT: 2em">Since serverA serial was greater than serverB ,
serverC can get dns update data from serverA but cannot get update from
serverB.</DIV>
<DIV style="TEXT-INDENT: 2em">How to deal with this
serial problem , can anyone give some advice?</DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV>
<DIV><BR> </DIV></DIV>
<DIV> </DIV>
<DIV> </DIV>
<HR style="HEIGHT: 1px; WIDTH: 210px" align=left color=#b5c4df SIZE=1>
<DIV>2014-09-16 16:10:44</DIV>
<DIV>gaolei</DIV>
<DIV
style="BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; BORDER-BOTTOM: medium none; PADDING-BOTTOM: 0cm; PADDING-TOP: 3pt; PADDING-LEFT: 0cm; BORDER-LEFT: medium none; PADDING-RIGHT: 0cm">
<DIV
style="FONT-SIZE: 12px; FONT-FAMILY: tahoma; BACKGROUND: #efefef; COLOR: #000000; PADDING-BOTTOM: 8px; PADDING-TOP: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px">
<DIV><B>From:</B> <A href="mailto:shlyoko@gmail.com">Emil Natan</A></DIV>
<DIV><B>Date:</B> 2014-08-24 21:20</DIV>
<DIV><B>To:</B> <A href="mailto:gaolei@knet.cn">gaolei</A></DIV>
<DIV><B>CC:</B> <A
href="mailto:opendnssec-user@lists.opendnssec.org">opendnssec-user</A></DIV>
<DIV><B>Subject:</B> Re: [Opendnssec-user] About High Availablity for
OpenDNSSEC</DIV></DIV></DIV>
<DIV>
<DIV class=FoxDiv20140916161044512889 style="BACKGROUND-COLOR: white">
<DIV dir=ltr>Hi,
<DIV class=gmail_extra><BR><BR>
<DIV class=gmail_quote>On Sun, Aug 24, 2014 at 3:59 PM, gaolei <SPAN
dir=ltr><<A href="mailto:gaolei@knet.cn"
target=_blank>gaolei@knet.cn</A>></SPAN> wrote:<BR>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid"><U></U>
<DIV style="MARGIN: 10px">
<DIV>
<DIV> </DIV></DIV>
<DIV>
<DIV style="BACKGROUND-COLOR: white">
<DIV>
<DIV>
<DIV><FONT face=Verdana>Hi all,</FONT></DIV>
<DIV> </DIV>
<DIV style="TEXT-INDENT: 2em">From KNET , I notice there is a topic about
opendnssec High Availablity at <A
href="https://wiki.opendnssec.org/display/DOCS/High+availability"
target=_blank>https://wiki.opendnssec.org/display/DOCS/High+availability</A>
</DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV>
<DIV style="TEXT-INDENT: 2em">But I was a little puzzled by this page.</DIV>
<DIV style="TEXT-INDENT: 2em"> </DIV>
<DIV style="TEXT-INDENT: 2em">It mentioned about master/slave like
this:</DIV>
<DIV style="TEXT-INDENT: 2em">
<H2
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(255,126,0); PADDING-BOTTOM: 0px; BORDER-BOTTOM-COLOR: rgb(102,153,204); PADDING-TOP: 0px; FONT: 20px/1.5 Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 30px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px">Master/Slave</H2>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px"><FONT
color=#ff9900>Careful consideration should be given to which, if any, process
are run on a slave (or on each master in a Master-Master) configuration. Some
operators don't run either the enforcer or the signer on a slave instance but
merely duplicate the data between the two instances in a timely fashion.
Others run two master servers, both enforcing and signing but only publishing
from an 'active' master</FONT>.</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px"> </P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">I'm
wondering what will happen to the rollover of keys if we make a
master-master deployment.</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">1.Mysql
used to store keys data , and</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">2.HSM
machine employed to generate keys , and</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">3.Two
opendnssec instances running on seperate servers for the same zone</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">Will
the two opendnssec instances generate different keys for the same zone? If so
, it seems as if it will bring troubles when the 'active' master is
down ?</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em"></P></DIV></DIV></DIV></DIV></DIV></DIV></BLOCKQUOTE>
<DIV><BR></DIV>
<DIV>Yes, the two instances will generate different keys and that will cause
problems on switching between the two signers. It's not clear if you plan to use
separate HSM for each of the ODS instances, but what you generally do is
pre-generate keys and have them synced in case of two HSMs. The MySQL on both
signers should be in sync, the HSM key mapping files as well so basically the
two signers sign the zone using the same keys.</DIV>
<DIV>Here is another thread of the mailing list discussing HA.</DIV>
<DIV><A
href="http://lists.opendnssec.org/pipermail/opendnssec-user/2014-June/003024.html">http://lists.opendnssec.org/pipermail/opendnssec-user/2014-June/003024.html</A><BR></DIV>
<DIV><BR></DIV>
<DIV>HTH</DIV>
<DIV><BR></DIV>
<DIV>Emil</DIV>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV style="MARGIN: 10px">
<DIV>
<DIV style="BACKGROUND-COLOR: white">
<DIV>
<DIV>
<DIV style="TEXT-INDENT: 2em">
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em"> </P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">Can anyone
give more suggestions on the High Availablity of opendnssec ?</P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em"> </P>
<P
style="WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; COLOR: rgb(51,51,51); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; FONT: 14px/20px Arial,sans-serif; PADDING-LEFT: 0px; MARGIN: 10px 0px 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 2em">Best
Regards!</P></DIV></DIV></DIV>
<DIV> </DIV>
<HR style="WIDTH: 210px; MIN-HEIGHT: 1px" align=left color=#b5c4df SIZE=1>
<DIV>2014-08-24 18:05:37</DIV><SPAN><FONT color=#888888>
<DIV>gaolei</DIV></FONT></SPAN></DIV></DIV></DIV><BR>_______________________________________________<BR>Opendnssec-user
mailing list<BR><A
href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</A><BR><A
href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user"
target=_blank>https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</A><BR><BR></BLOCKQUOTE></DIV><BR></DIV></DIV></DIV></DIV></BODY></HTML>