<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div><div class="markdown">
<p dir="auto">Following my adventures upgrading a moderately neglected (but well automated!) installation last month, I've been poking around the filesystem looking for stale things that might come and bite me later.</p>
<p dir="auto">I discovered that I have 10016 files in /var/db/softhsm, 5006 of which are named *.object. This seems a little excessive for 22 zones with fairly boring policies:</p>
<pre><code><Keys>
<TTL>PT86400S</TTL>
<RetireSafety>PT14400S</RetireSafety>
<PublishSafety>PT14400S</PublishSafety>
<Purge>P14D</Purge>
<KSK>
<Algorithm length="256">13</Algorithm>
<Lifetime>P1Y</Lifetime>
<Repository>SoftHSM</Repository>
</KSK>
<ZSK>
<Algorithm length="256">13</Algorithm>
<Lifetime>P90D</Lifetime>
<Repository>SoftHSM</Repository>
</ZSK>
</Keys>
</code></pre>
<p dir="auto">My enforcer setting is pretty boring too:</p>
<pre><code><AutomaticKeyGenerationPeriod>P14D</AutomaticKeyGenerationPeriod>
</code></pre>
<p dir="auto">Digging a little deeper, I found this:</p>
<h1>sqlite3 /usr/local/var/opendnssec/kasp.db</h1>
<p dir="auto">sqlite> select count(<em>) from hsmKey;<br />
3516<br />
sqlite> select count(</em>) from hsmKey where algorithm != 13;<br />
2106</p>
<p dir="auto">This would suggest there are about 1500 keys known to softhsm2 that aren't known to OpenDNSSEC. Moreover, there are 2106 RSA keys known to OpenDNSSEC but not used by any zones (all my policies are ECC).</p>
<p dir="auto">I suspect that these were pre-generated keys for long-gone zones.</p>
<p dir="auto">Does anyone have any scripts to make more sense of what's in softhsm2 and in the OpenDNSSEC database?</p>
<p dir="auto">Thanks!</p>
<p dir="auto">Best wishes.<br />
Philip</p>
<p dir="auto">--<br />
Philip Paeps<br />
Senior Reality Engineer<br />
Alternative Enterprises</p>
</div></div>
</body>
</html>