[Opendnssec-user] Old policies in database
Casper Gielen
C.Gielen at uvt.nl
Fri Nov 18 09:26:07 UTC 2011
Hello,
I just discovered that there are a number of old policies in the database that are no longer in kasp.xml:
# grep name /etc/opendnssec/kasp.xml
<Policy name="uvtonly">
<Policy name="fulldnssec">
<Policy name="testshort">
# ods-ksmutil policy list
Policies:
Name: Description:
default A default ...
fulldnssec Policy voor ....
nostandby Policy without...
nostandbykeys Policy without...
testshort Test policy for ....
uvtonly Zones that ...
I wanted to remove the 'default' policy to ensure that every zone has a purposefully
selected policy instead of the lazy default. But a test shows that the 'default' policy
is still usable:
# ods-ksmutil zone list |grep default
Found Zone: uvttestexample.com; on policy default
Unfortunately the 'default' zone is still in the database and it will be used when asked to:
root at metagross:~# ods-ksmutil key list --zone uvttestexample.com
Keys:
Zone: Keytype: State: Date of next transition:
uvttestexample.com ZSK active 2011-12-18 10:05:19
uvttestexample.com KSK publish 2011-11-18 12:35:19
No other zone uses the "default" policy.
Here are some (slightly cleaned) logs:
Nov 18 10:05:19 metagross ods-enforcerd: Zone uvttestexample.com found.
Nov 18 10:05:19 metagross ods-enforcerd: Policy for uvttestexample.com set to default.
Nov 18 10:05:19 metagross ods-enforcerd: Policy default found in DB.
Nov 18 10:05:19 metagross ods-enforcerd: Config will be output to /var/lib/opendnssec/signconf/uvttestexample.com.xml.
Nov 18 10:05:19 metagross ods-enforcerd: INFO: Promoting ZSK from publish to active as this is the first pass for the zone
Nov 18 10:05:19 metagross ods-signerd: [cmdhandler] received command update uvttestexample.com[25]
Nov 18 10:05:19 metagross ods-signerd: [worker[4]] load signconf for zone uvttestexample.com
Nov 18 10:05:19 metagross ods-signerd: [signconf] zone uvttestexample.com signconf: RESIGN[PT7200S] REFRESH[PT259200S] VALIDITY[PT604800S] DENIAL[PT604800S] JITTER[PT43200S] OFFSET[PT3600S] NSEC[50] DNSKEYTTL[PT3600S] SOATTL[PT3600S] MINIMUM[PT3600S] SERIAL[datecounter] AUDIT[1]
Nov 18 10:05:19 metagross ods-signerd: [zone] zone uvttestexample.com set DNSKEY TTL to 3600
Nov 18 10:05:19 metagross ods-signerd: [zone] zone uvttestexample.com set DNSKEY TTL to 3600
Nov 18 10:05:20 metagross ods-signerd: [worker[4]] read zone uvttestexample.com
Nov 18 10:05:20 metagross ods-signerd: [adapter] read zone uvttestexample.com from file input adapter /var/lib/opendnssec/unsigned/uvttestexample.com
Nov 18 10:05:20 metagross ods-signerd: [zone] zone uvttestexample.com set SOA TTL to 3600
Nov 18 10:05:20 metagross ods-signerd: [zone] zone uvttestexample.com set SOA MINIMUM to 3600
Nov 18 10:05:20 metagross ods-signerd: [tools] commit updates for zone uvttestexample.com
Nov 18 10:05:20 metagross ods-signerd: [worker[4]] nsecify zone uvttestexample.com
Nov 18 10:05:20 metagross ods-signerd: [worker[4]] sign zone uvttestexample.com
Nov 18 10:05:20 metagross ods-signerd: [worker[4]] audit zone uvttestexample.com
Nov 18 10:05:20 metagross ods-auditor[27960]: Auditor started
Nov 18 10:05:20 metagross ods-auditor[27960]: Can't load uvttestexample.com SignerConfiguration file (/var/lib/opendnssec/signconf/uvttestexample.com.xml) : ERROR - Can't find KASP file : "/etc/opendnssec/kasp.xml" : ERROR - Can't find policy "default" in KASP Policy.
Nov 18 10:05:20 metagross ods-auditor[27960]: Can't find uvttestexample.com zone in zonelist
Nov 18 10:05:20 metagross ods-signerd: [worker[4]] backoff task [read] for zone uvttestexample.com with 60 seconds
Nov 18 10:06:20 metagross ods-signerd: [worker[4]] read zone uvttestexample.com
Nov 18 10:06:20 metagross ods-signerd: [adapter] read zone uvttestexample.com from file input adapter /var/lib/opendnssec/unsigned/uvttestexample.com
Nov 18 10:06:20 metagross ods-signerd: [zone] zone uvttestexample.com set SOA TTL to 3600
Nov 18 10:06:20 metagross ods-signerd: [zone] zone uvttestexample.com set SOA MINIMUM to 3600
Nov 18 10:06:20 metagross ods-signerd: [tools] commit updates for zone uvttestexample.com
Nov 18 10:06:20 metagross ods-signerd: [worker[4]] nsecify zone uvttestexample.com
Nov 18 10:06:20 metagross ods-signerd: [worker[4]] sign zone uvttestexample.com
Nov 18 10:06:20 metagross ods-signerd: [worker[4]] audit zone uvttestexample.com
Nov 18 10:06:21 metagross ods-auditor[27994]: Auditor started
Nov 18 10:06:21 metagross ods-auditor[27994]: Can't load uvttestexample.com SignerConfiguration file (/var/lib/opendnssec/signconf/uvttestexample.com.xml) : ERROR - Can't find KASP file : "/etc/opendnssec/kasp.xml" : ERROR - Can't find policy "default" in KASP Policy.
Nov 18 10:06:21 metagross ods-auditor[27994]: Can't find uvttestexample.com zone in zonelist
Nov 18 10:06:21 metagross ods-signerd: [worker[4]] backoff task [read] for zone uvttestexample.com with 120 seconds
Nov 18 10:08:21 metagross ods-signerd: [worker[4]] read zone uvttestexample.com
Nov 18 10:08:21 metagross ods-signerd: [adapter] read zone uvttestexample.com from file input adapter /var/lib/opendnssec/unsigned/uvttestexample.com
Nov 18 10:08:21 metagross ods-signerd: [zone] zone uvttestexample.com set SOA TTL to 3600
Nov 18 10:08:21 metagross ods-signerd: [zone] zone uvttestexample.com set SOA MINIMUM to 3600
Nov 18 10:08:21 metagross ods-signerd: [tools] commit updates for zone uvttestexample.com
Nov 18 10:08:21 metagross ods-signerd: [worker[4]] nsecify zone uvttestexample.com
Nov 18 10:08:21 metagross ods-signerd: [worker[4]] sign zone uvttestexample.com
Nov 18 10:08:21 metagross ods-signerd: [worker[4]] audit zone uvttestexample.com
Nov 18 10:08:21 metagross ods-auditor[28402]: Auditor started
Nov 18 10:08:22 metagross ods-auditor[28402]: Can't load uvttestexample.com SignerConfiguration file (/var/lib/opendnssec/signconf/uvttestexample.com.xml) : ERROR - Can't find KASP file : "/etc/opendnssec/kasp.xml" : ERROR - Can't find policy "default" in KASP Policy.
Nov 18 10:08:22 metagross ods-auditor[28402]: Can't find uvttestexample.com zone in zonelist
Nov 18 10:08:22 metagross ods-signerd: [worker[4]] backoff task [read] for zone uvttestexample.com with 240 seconds
Nov 18 10:09:01 metagross ods-enforcerd: Zone uvttestexample.com found.
Nov 18 10:09:01 metagross ods-enforcerd: Policy for uvttestexample.com set to default.
Nov 18 10:09:01 metagross ods-enforcerd: Policy default found in DB.
Nov 18 10:09:01 metagross ods-enforcerd: Config will be output to /var/lib/opendnssec/signconf/uvttestexample.com.xml.
Nov 18 10:09:01 metagross ods-enforcerd: WARNING: KSK rollover for zone 'uvttestexample.com' not completed as there are no keys in the 'ready' state; ods-enforcerd will try again when it runs next
Nov 18 10:09:01 metagross ods-enforcerd: No change to: /var/lib/opendnssec/signconf/uvttestexample.com.xml
--
Casper Gielen <cgielen at uvt.nl> | LIS UNIX
PGP fingerprint = 16BD 2C9F 8156 C242 F981 63B8 2214 083C F80E 4AF7
Universiteit van Tilburg | Postbus 90153, 5000 LE
Warandelaan 2 | Telefoon 013 466 4100 | G 236 | http://www.uvt.nl
More information about the Opendnssec-user
mailing list