[Opendnssec-user] Purging unreferenced keys from softhsm2
philip at trouble.is
Fri Jul 9 07:17:40 UTC 2021
Following my adventures upgrading a moderately neglected (but well
automated!) installation last month, I've been poking around the
filesystem looking for stale things that might come and bite me later.
I discovered that I have 10016 files in /var/db/softhsm, 5006 of which
are named *.object. This seems a little excessive for 22 zones with
fairly boring policies:
My enforcer setting is pretty boring too:
Digging a little deeper, I found this:
# sqlite3 /usr/local/var/opendnssec/kasp.db
sqlite> select count(*) from hsmKey;
sqlite> select count(*) from hsmKey where algorithm != 13;
This would suggest there are about 1500 keys known to softhsm2 that
aren't known to OpenDNSSEC. Moreover, there are 2106 RSA keys known to
OpenDNSSEC but not used by any zones (all my policies are ECC).
I suspect that these were pre-generated keys for long-gone zones.
Does anyone have any scripts to make more sense of what's in softhsm2
and in the OpenDNSSEC database?
Senior Reality Engineer
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Opendnssec-user