26 Lis
2018
26 Lis
'18
14:34
Thank you Petr for a response.
My zone contents is (I believe) quite typical: mix of "normal" records
(A, AAAA, CNAME, etc.) that are modified at master and replicated using
notify/refresh to the slave and synthesized AAAA records (by the
mod-synthrecord module). In the meantime, I've got a good explanation
from Libor Peltán. Thanks once more,
Oto
Dne 26.11.2018 v 13:33 Petr Špaček napsal(a):
On 26. 11. 18 7:22, Oto Stefan wrote:
Hello,
first of all I would like to express many thanks to the CZ.NIC DNS team
for an amazing piece of software which the KnotDNS in my view surely is.
Well, to my question. I run two instances of knot 2.6.9 in the
master-slave configuration which serve a couple of zones. The zones are
DNSSEC signed at master with an automated key management. This works
excellent even with the KSK rotation (I am under .cz TLD). However, I
also have a subdomain (i.e., 3rd order domain) with synthesized records.
The only way to allow DNSSEC for it I was able to find is:
- using mod-onlinesign on both the master and slave,
- generating a key externally (with bind-utils) and importing it into
KASP on both servers,
- configuring manual key policy,
- adding the appropriate DS record into the parent zone.
This seems to work fine, all the validation tests pass.
The question is: Is there a better way to achieve the goal (especially
with new features like automated key rotation in online signing of the
2.7 version in mind) or what is the recommended practice in a similar
situation?
Hmm, could you share configuration snippets from master and slave to
show us how exactly you are generating records and how you synchronize
"generation rules" between master and slaves?
Thanks!