Good afternoon,
I made a change in our zone, changed serial of the zone and reload
the zone. When I check the syslog, I saw some complains, that the
signatures was out of date. For example:
Sep 26 11:31:17 slimak knot[22992]: [warning] Semantic warning in
node: slimak.fnhk.cz.: RRSIG: Expired signature! Record type: A.
Sep 26 11:31:17 slimak knot[22992]: [warning] Semantic warning in
node: slimak.fnhk.cz.: RRSIG: Expired signature! Record type: AAAA.
Sep 26 11:31:17 slimak knot[22992]: [warning] Semantic warning in
node: slimak.fnhk.cz.: RRSIG: Expired signature! Record type: NSEC.
This happens for all records in the zone.
Last change was 11.8.2014, knot signed it and planned resign to 7.9.2014:
Aug 11 13:39:10 slimak knot[22992]: Semantic checks completed for
zone=fnhk.cz.
Aug 11 13:39:10 slimak knot[22992]: Zone 'fnhk.cz.' reloaded (serial
2014081101)
Aug 11 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz. - Signing started...
Aug 11 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz. - - Key is
valid, tag 64431, file Kfnhk.cz.+005+64431.private, ZSK, active, public
Aug 11 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz. - - Key is
valid, tag 26812, file Kfnhk.cz.+005+26812.private, KSK, active, public
Aug 11 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz. -
Successfully signed.
Aug 11 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz.: Next
signing planned on 2014-09-07T11:39:10.
Aug 11 13:39:10 slimak knot[22992]: Loaded 5 out of 5 zones.
Aug 11 13:39:10 slimak knot[22992]: Applied differences of 'fnhk.cz.'
to zonefile.
Aug 11 13:39:10 slimak knot[22992]: Configuration reloaded.
Aug 11 13:39:10 slimak knot[22992]: NOTIFY of 'fnhk.cz.' to
'195.113.115.171@53': Query issued (serial 2014081102).
Aug 11 13:39:10 slimak knot[22992]: NOTIFY of 'fnhk.cz.' to
'195.113.123.91@53': Query issued (serial 2014081102).
Aug 11 13:39:10 slimak knot[22992]: NOTIFY of 'fnhk.cz.' to
'89.248.244.34@53': Query issued (serial 2014081102).
on 7.9.2014 the zone was resigned automatically:
Sep 7 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz. - Signing zone...
Sep 7 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz. - - Key is
valid, tag 64431, file Kfnhk.cz.+005+64431.private, ZSK, active, public
Sep 7 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz. - - Key is
valid, tag 26812, file Kfnhk.cz.+005+26812.private, KSK, active, public
Sep 7 13:39:10 slimak knot[22992]: DNSSEC: Zone fnhk.cz. -
Successfully signed.
Sep 7 13:39:11 slimak knot[22992]: NOTIFY of 'fnhk.cz.' to
'195.113.115.171@53': Query issued (serial 2014081103).
Sep 7 13:39:11 slimak knot[22992]: NOTIFY of 'fnhk.cz.' to
'195.113.123.91@53': Query issued (serial 2014081103).
Sep 7 13:39:11 slimak knot[22992]: NOTIFY of 'fnhk.cz.' to
'89.248.244.34@53': Query issued (serial 2014081103).
Sep 7 13:39:11 slimak knot[22992]: DNSSEC: Zone fnhk.cz.: Next
signing planned on 2014-10-04T11:39:10.
Sep 7 13:39:11 slimak knot[22992]: Outgoing IXFR of 'fnhk.cz.' to
'195.113.115.171@47363': Started (serial 2014081102 -> 2014081103).
Sep 7 13:39:11 slimak knot[22992]: Outgoing IXFR of 'fnhk.cz.' to
'195.113.115.171@47363': Serial 2014081102 -> 2014081103.
Sep 7 13:39:11 slimak knot[22992]: Outgoing IXFR of 'fnhk.cz.' to
'195.113.115.171@47363': Finished in 0.01s.
And after today's changes knot told me that the signatures was out of date.
I've this similar version of knot on my own server, there is no problem
Any ideas ?
Thanks and best regards
J.Karliak
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Hi,
I am currently testing knot and I have found a problem when CNAME
are in uppercase.
My primary server is running with BIND.
I have these two declarations :
myserver IN A 10.1.1.1
myserver-alias IN CNAME MYSERVER
On the knot secondary server, after zone transfer, all seems ok :
myserver.mydomain.fr. 900 A 10.1.1.1
myserver-alias.mydomain.fr. 900 CNAME MYSERVER.mydomain.fr.
But when I ask knot for myserver-alias, I have a NXDOMAIN response
(tcpdump output below) :
17:00:29.718834 IP dns-client.38146 > knot-server.domain: 4787+ A?
myserver-alias.mydomain.fr. (43)
17:00:29.719011 IP knot-server.domain > dns-client.38146:
4787 NXDomain*- 1/1/0 CNAME MYSERVER.mydomain.fr. (123)
17:00:29.719555 IP dns-client.54520 > knot-server.domain: 2945+ A?
myserver-alias.mydomain.fr.mydomain.fr. (54)
17:00:29.719637 IP knot-server.domain > dns-client.54520: 2945
NXDomain*- 0/1/0 (111)
Tested with knot 1.5.1 and 1.5.2
Best regards,
--
Didier ALBENQUE
SG/SDSI/BSE
Architecte technique
Le café est un breuvage qui fait dormir,
quand on n'en prend pas. Alphonse Allais
----------------------------------------------------------------------
Merci de nous aider à préserver l'environnement en n'imprimant ce courriel et les documents joints que si nécessaire.
Greetings
Regarding the gpg key used to sign http://deb.knot-dns.cz/debian/.
Any chance that that key could be available for downloaded by way of
https://, or perhaps just have its fingerprinted listed on
https://www.knot-dns.cz/pages/download.html?
While the https:// CA model is far from perfect it'd still like to think
it being a step up compared to regular http://, and at the same time a
lot easier to document than the process of following the signatures in a
gpg web of trust.
// Andreas
JFTR I did push the 1.5.2 to wheezy-backports directly
since 1.5.2 contains a remote vulnerability, so it's
available there - see https://tracker.debian.org/knot
Cheers,
--
Ondřej Surý -- Chief Science Officer
-------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Americka 23, 120 00 Praha 2, Czech Republic
mailto:ondrej.sury@nic.cz http://nic.cz/
-------------------------------------------
----- Original Message -----
> From: "Leoš Bitto" <leos.bitto(a)gmail.com>
> To: knot-dns-users(a)lists.nic.cz
> Sent: Tuesday, September 9, 2014 12:06:45 PM
> Subject: Re: [knot-dns-users] problem with debian repository
> On Tue, Sep 9, 2014 at 9:14 AM, Ondřej Caletka <ondrej.caletka(a)gmail.com> wrote:
>> Dne 22.8.2014 09:52, Peter Hudec napsal(a):
>>> Hi,
>>>
>>> this mail is directed for debian repository maintainers.
>>>
>>> The debian repository is not working properly, the Packages(.gz) and
>>> Sources(.gz) files are empty.
>>>
>>
>> I'm observing same problem. However, I've noticed that latest version of
>> Knot is available in official wheezy-backports tree.
>>
>
> http://deb.knot-dns.cz/debian/dists/wheezy/ does not work for me, too.
> However I do not agree with the availability in the official
> wheezy-backports
> (http://ftp.cz.debian.org/debian/dists/wheezy-backports/ in my case) -
> the previous version 1.5.1 was not there until the last week, and the
> current version 1.5.2 is not there at all (which might actually be a
> good thing due to https://gitlab.labs.nic.cz/labs/knot/issues/294).
>
>
> Leoš Bitto
> _______________________________________________
> knot-dns-users mailing list
> knot-dns-users(a)lists.nic.cz
> https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
Could you please flush your DNS cache (deb.knot-dns.cz
should point to sophie.nic.cz now) and try again?
The debarchive got broken and I couldn't fix it, so
it has been replaced by reprepro.
In case you can't flush your caches, please just temporarily
change deb.knot-dns.cz to sophie.nic.cz.
Also the repository is now signed:
# wget -O - http://deb.knot-dns.cz/debian/apt.key | apt-key add -
Full instructions can be found here:
http://deb.knot-dns.cz/debian/README.txt
Ondrej
--
Ondřej Surý -- Chief Science Officer
-------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Americka 23, 120 00 Praha 2, Czech Republic
mailto:ondrej.sury@nic.cz http://nic.cz/
-------------------------------------------
----- Original Message -----
> From: "Leoš Bitto" <leos.bitto(a)gmail.com>
> To: knot-dns-users(a)lists.nic.cz
> Sent: Tuesday, September 9, 2014 12:06:45 PM
> Subject: Re: [knot-dns-users] problem with debian repository
> On Tue, Sep 9, 2014 at 9:14 AM, Ondřej Caletka <ondrej.caletka(a)gmail.com> wrote:
>> Dne 22.8.2014 09:52, Peter Hudec napsal(a):
>>> Hi,
>>>
>>> this mail is directed for debian repository maintainers.
>>>
>>> The debian repository is not working properly, the Packages(.gz) and
>>> Sources(.gz) files are empty.
>>>
>>
>> I'm observing same problem. However, I've noticed that latest version of
>> Knot is available in official wheezy-backports tree.
>>
>
> http://deb.knot-dns.cz/debian/dists/wheezy/ does not work for me, too.
> However I do not agree with the availability in the official
> wheezy-backports
> (http://ftp.cz.debian.org/debian/dists/wheezy-backports/ in my case) -
> the previous version 1.5.1 was not there until the last week, and the
> current version 1.5.2 is not there at all (which might actually be a
> good thing due to https://gitlab.labs.nic.cz/labs/knot/issues/294).
>
>
> Leoš Bitto
> _______________________________________________
> knot-dns-users mailing list
> knot-dns-users(a)lists.nic.cz
> https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
I have following issue with Knot: when I try to stop it by command
/etc/init.d/knot stop then the daemon is still running. If i run command
knotc stop then it's stopped but immediately run again. If I kill it by
command kill, it's the same...
As I found the /etc/init.d/knot is not working at all and Knot is
probably run during boot by /etc/init/knot.conf and I'm not able to
control it. The "unkillable" proccess is named /usr/sbin/knotd -c
/etc/knot/knot.conf
My environment: Debian 7 AMD64, OpenVZ container, kernel
2.6.32-openvz-042stab092.2-amd64, Knot 1.5.0-1
I tried to install Knot on another older machine where is Debian 7 too
but upgraded from 6 and it's KVM virtual machine. There it works
correctly via init.d script and the proccess is named /usr/sbin/knotd
*-d* -c /etc/knot/knot.conf
Do you have an idea why it's working on older machine correctly and on
the second with OpenVZ not?
Thanks for any help.
Zdenek Z.
