[Opendnssec-user] termination of obs2 DelegationSignerSubmitCommand input stream missing?

PGNet Dev pgnet.dev at gmail.com
Mon Dec 19 22:22:56 UTC 2016


On 12/19/2016 01:59 PM, Yuri Schaeffer wrote:
>> I suspect it's waiting for termination.
> 
> At this point I haven't looked in to it yet but judging from your mail
> I'd say the script simply isn't called yet. It takes some time for the
> zone to be ready to introduce the DS records. Only when it is it will
> call the script.
> 
> Try "ods-enforcer key list". If the state of the KSK isn't 'waiting for
> ds-seen' the DS record is simply not submitted.

that shows that it IS ...

	/usr/local/opendnssec/sbin/ods-enforcer key list --verbose
		Keys:
		Zone:                           Keytype: State:    Date of next transition: Size: Algorithm: CKA_ID:                          Repository: KeyTag:
		example.info                    KSK      ready     waiting for ds-seen      2048  8          690c90a78f1ba38fcbf76f248a4fe47e SoftHSM     56995
		example.info                    ZSK      active    2016-12-19 17:25:55      1024  8          0c60caf105ce9edef9048b19eed84db9 SoftHSM     6126

reading,

	https://www.opendnssec.org/documentation/using-opendnssec/

suggests exec'ing

	/usr/local/opendnssec/sbin/ods-ksmutil key ds-seen -z example.info -x 56995

but

	ls /usr/local/opendnssec/sbin/ods-ksmutil
		ls: cannot access '/usr/local/opendnssec/sbin/ods-ksmutil': No such file or directory
	find /usr/local/opendnssec/ | grep ksm
		(empty)

this

	https://wiki.opendnssec.org/display/DOCS20/conf.xml

refers to

	ods-ksmutil

@ src, 

	cat NEWS
		...
		* OPENDNSSEC-390: ods-ksmutil: Add an option to the 'ods-ksmutil key ds-seen'
		  command so the user can choose not to notify the enforcer.
		...

after a bit of digging, seems !ods-ksmutil, but ods-enforcer is to be used (would be helpful if DOCS reflected that)

	/usr/local/opendnssec/sbin/ods-enforcer key ds-seen -z example.info -x 56995
		1 KSK matches found.
		1 KSKs changed.

now,

	/usr/local/opendnssec/sbin/ods-enforcer key list --verbose
		Keys:
		Zone:                           Keytype: State:    Date of next transition: Size: Algorithm: CKA_ID:                          Repository: KeyTag:
		example.info                    KSK      active    2016-12-19 17:25:55      2048  8          690c90a78f1ba38fcbf76f248a4fe47e SoftHSM     56995
		example.info                    ZSK      active    2016-12-19 17:25:55      1024  8          0c60caf105ce9edef9048b19eed84db9 SoftHSM     6126

So a state change, but still no email sent.

Is there another step, or different action, needed?






More information about the Opendnssec-user mailing list