29 Pro
2015
29 Pro
'15
12:03
Hi everyone,
I'd like to manage the directory holding all the zonefiles in git to have a
workflow like "git push -> webhook -> zonefiles git pull -> knotc
reload".
With Knot versions <2 this was working great because Knot did not change
anything in this directory. But when using Knot 2.x with DNSSEC enabled, Knot
rewrites the zonefiles of DNSSEC enabled zones, creates a timers subdirectory
and puts some *.db files into the zones directory. Are there any configuration
parameters to change this behaviour? So that the timers subdirectory is
created outside the directory holding zonefiles (preferably configurable), the
*.db files are also written into a dedicated directory and signed zonefiles are
saved into a different subdirectory.
Or are there any proposals how I could manage the zonefiles directory with git
when using Knot 2.x with DNSSEC enabled?
Thanks a lot for all input.
Cheers and happy new year!
Tobias
29 Pro
29 Pro
12:37
Hi Tobias,
my configuration looks like this:
```
template:
- id: "default"
storage: "/var/lib/knot"
zonefile-sync: "0"
dnssec-signing: "on"
kasp-db: "/etc/knot/keys"
serial-policy: "unixtime"
notify: [ "trubka" ]
acl: [ "acl_trubka" ]
file: "/etc/knot/zones/%s"
```
We don't have an option to write signed zonefile elsewhere, but you can set
`zonefile-sync: -1`[1] to disable syncing of the zones to the disk. That way the
signatures will be kept only in the zone journal.
1. https://www.knot-dns.cz/docs/2.0/html/reference.html#zonefile-sync
Cheers,
Ondrej
--
Ondřej Surý -- Technical Fellow
--------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Milesovska 5, 130 00 Praha 3, Czech Republic
mailto:ondrej.sury@nic.cz https://nic.cz/
--------------------------------------------
----- Original Message -----
From: "Tobias Brunner"
<tobias(a)tobru.ch>
To: knot-dns-users(a)lists.nic.cz
Sent: Tuesday, December 29, 2015 12:03:55 PM
Subject: [knot-dns-users] Manage zonefile directory in git
Hi everyone,
I'd like to manage the directory holding all the zonefiles in git to have a
workflow like "git push -> webhook -> zonefiles git pull -> knotc
reload".
With Knot versions <2 this was working great because Knot did not change
anything in this directory. But when using Knot 2.x with DNSSEC enabled, Knot
rewrites the zonefiles of DNSSEC enabled zones, creates a timers subdirectory
and puts some *.db files into the zones directory. Are there any configuration
parameters to change this behaviour? So that the timers subdirectory is
created outside the directory holding zonefiles (preferably configurable), the
*.db files are also written into a dedicated directory and signed zonefiles are
saved into a different subdirectory.
Or are there any proposals how I could manage the zonefiles directory with git
when using Knot 2.x with DNSSEC enabled?
Thanks a lot for all input.
Cheers and happy new year!
Tobias
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
13:28
Hi Ondrej,
Thanks for your fast answer!
my configuration looks like this:
```
template:
- id: "default"
storage: "/var/lib/knot"
zonefile-sync: "0"
dnssec-signing: "on"
kasp-db: "/etc/knot/keys"
serial-policy: "unixtime"
notify: [ "trubka" ]
acl: [ "acl_trubka" ]
file: "/etc/knot/zones/%s"
```
We don't have an option to write signed zonefile elsewhere, but you can set
`zonefile-sync: -1`[1] to disable syncing of the zones to the disk. That
way the signatures will be kept only in the zone journal.
1. https://www.knot-dns.cz/docs/2.0/html/reference.html#zonefile-sync
That's great! This solves all of my "troubles" I had...
Cheers,
Tobias
4 Led
4 Led
12:47
* Tobias Brunner <tobias(a)tobru.ch>
Hi Ondrej,
Thanks for your fast answer!
Be aware that with "zonefile-sync: -1" the journal will grow and grow
until it is full, as it doesn't only contain a simple diff/delta from
the original file (in git), but every single change applied - even
those changes that have been cancelled out by later changes (like old
DNSSEC signatures).
When the journal is full, you cannot submit further nsupdate changes
and I think DNSSEC re-signing is prevented from happening. Therefore,
as I understand it, "zonefile-sync: -1" is not suited for production
use.
See also https://gitlab.labs.nic.cz/labs/knot/issues/164#note_12079
Tore
We don't have an option to write signed
zonefile elsewhere, but you can set
`zonefile-sync: -1`[1] to disable syncing of the zones to the disk. That
way the signatures will be kept only in the zone journal.
1. https://www.knot-dns.cz/docs/2.0/html/reference.html#zonefile-sync
That's great! This solves all of my "troubles" I had... 
15:12
Hello Tobias,
On Tuesday, December 29, 2015 01:28:20 PM Tobias Brunner wrote:
Beware, this is very tricky.
Knot tries to apply the changes from journal on top of the zone file. For this
purpose, it uses the zone SOA serial as the only indicator of zone version.
Nothing else.
If you give Knot DNS a zone file with serial X, assumming DNSSEC signing
enabled, the server will update the zone with serial X+1. The difference
between X and X+1 is written into the journal. Another resigning will increase
the serial again. And so on.
So if your zone file still contains serial X, but the journal contains much
newer version (let's say X+10), and you decide to change the zone file, you
*must* set the newer serial in the zone file at least to X+11. Otherwise, your
zone will get inconsistent because Knot will try to apply the changes in
journal on top of the updated zone.
What's more, we obviously cannot reuse valid signatures from the journal when
the journal get's out-of-sync from the zone. It's cheaper to resign the zone.
Also, zonefile-sync to -1 just disables periodical flushing of the journal.
The journal can be still flushed when it's full.
So having the zones in git including signatures is actually a good solution.
Just saying...
Cheers,
Jan
We don't
have an option to write signed zonefile elsewhere, but you can
set
`zonefile-sync: -1`[1] to disable syncing of the zones to the disk. That
way the signatures will be kept only in the zone journal.
1. https://www.knot-dns.cz/docs/2.0/html/reference.html#zonefile-sync
That's great! This solves all of my "troubles" I had...
16:20
Hi Jan,
Thanks a lot for your input.
Beware, this is very tricky.
Knot tries to apply the changes from journal on top of the zone file. For
this purpose, it uses the zone SOA serial as the only indicator of zone
version. Nothing else.
If you give Knot DNS a zone file with serial X, assumming DNSSEC signing
enabled, the server will update the zone with serial X+1. The difference
between X and X+1 is written into the journal. Another resigning will
increase the serial again. And so on.
So if your zone file still contains serial X, but the journal contains much
newer version (let's say X+10), and you decide to change the zone file, you
*must* set the newer serial in the zone file at least to X+11. Otherwise,
your zone will get inconsistent because Knot will try to apply the changes
in journal on top of the updated zone.
What's more, we obviously cannot reuse valid signatures from the journal
when the journal get's out-of-sync from the zone. It's cheaper to resign
the zone.
Also, zonefile-sync to -1 just disables periodical flushing of the journal.
The journal can be still flushed when it's full.
So having the zones in git including signatures is actually a good solution.
Just saying...
Is there a feature in Knot where I can leave out the serial and just put a
placeholder there? So that Knot manages the serial by itself? Knot could then
f.e. look at the timestamp of the zonefile to decide if it needs to update the
zone serial (f.e. unix timestamp) and reload the zone.
Are there any other suggestions how to manage zonefiles in Git when using
DNSSEC? Is it a problem when replacing the zonefile every time with an unsigned
one and let Knot resign the whole zone, or zones, because with a git reset all
zonefiles will be replaced by the original files? Looks like this would cause a
lot of troubles because of the automatic serial increment when signing a zone.
Setting zonefile-sync to -1 seems not to be a great idea in production...
General question: How are others managing zonefiles besides in Git?
Cheers,
Tobias
17:04
Hello.
On Monday, January 04, 2016 04:20:38 PM Tobias Brunner wrote:
Is there a feature in Knot where I can leave out the
serial and just put a
placeholder there? So that Knot manages the serial by itself? Knot could
then f.e. look at the timestamp of the zonefile to decide if it needs to
update the zone serial (f.e. unix timestamp) and reload the zone.
There is not at the moment. But I agree that it would be very useful. And
I think the first step towards a real solution would be to store the
automatically generated records separately. But this brings complications with
DDNS, with intentionally broken zones containing garbage, etc..
Are there any other suggestions how to manage
zonefiles in Git when using
DNSSEC? Is it a problem when replacing the zonefile every time with an
unsigned one and let Knot resign the whole zone, or zones, because with a
git reset all zonefiles will be replaced by the original files? Looks like
this would cause a lot of troubles because of the automatic serial
increment when signing a zone. Setting zonefile-sync to -1 seems not to be
a great idea in production...
There will always be a possibility, that Knot will resign the zone at the time
interval, when the zone file will be updated. What I do when I manually edit
the zone file, is to run 'knotc flush' and 'knotc status' first to check
when
the automatic signing will take place. Just to make sure that I'm in the safe
interval.
There is no problem in resigning the zone, if your zone has reasonable size.
The only danger is just related to the serial number handling.
I think the problem can be also solved by a bit more intelligent git hook. The
hook can execute 'knotc flush', then extract the DNSKEY, RRSIG, and NSEC/NSEC3
records from the flushed zone. Take the input zone from git, append these
records to the zone file, increase the serial and reload the server. Should
not be that hard...
General question: How are others managing zonefiles
besides in Git?
I would like to know that as well. :-)
Cheers,
Jan
17:30
Le lundi 04 janvier 2016 à 17:04 +0100, Jan Včelák a écrit :
[...]
Hello.
I have some zone.in files in git, and a makefile, which
concatenates the .in file(s) in a temporary file, updates the serial if
needed and generate the zone file itself ; then it reloads knot via
knotc.
The zone files themselves are in the gitignore file.
Regards,
--
Bastien Durel
General question: How are others managing
zonefiles besides in Git?
I would like to know that as well. :-)
Cheers,
Jan
17:27
----- Original Message -----
From: "Tobias Brunner"
<tobias(a)tobru.ch>
To: "Jan Včelák" <jan.vcelak(a)nic.cz>
Cc: knot-dns-users(a)lists.nic.cz, "Ondřej Surý" <ondrej.sury(a)nic.cz>
Sent: Monday, January 4, 2016 4:20:38 PM
Subject: Re: [knot-dns-users] Manage zonefile directory in git
Hi Jan,
Thanks a lot for your input.
You can just use
`serial-policy: unixtime` for just that (the actual SERIAL in the zone is irrelevant)
Beware, this is very tricky.
Knot tries to apply the changes from journal on top of the zone file. For
this purpose, it uses the zone SOA serial as the only indicator of zone
version. Nothing else.
If you give Knot DNS a zone file with serial X, assumming DNSSEC signing
enabled, the server will update the zone with serial X+1. The difference
between X and X+1 is written into the journal. Another resigning will
increase the serial again. And so on.
So if your zone file still contains serial X, but the journal contains much
newer version (let's say X+10), and you decide to change the zone file, you
*must* set the newer serial in the zone file at least to X+11. Otherwise,
your zone will get inconsistent because Knot will try to apply the changes
in journal on top of the updated zone.
What's more, we obviously cannot reuse valid signatures from the journal
when the journal get's out-of-sync from the zone. It's cheaper to resign
the zone.
Also, zonefile-sync to -1 just disables periodical flushing of the journal.
The journal can be still flushed when it's full.
So having the zones in git including signatures is actually a good solution.
Just saying...
Is there a feature in Knot where I can leave out the serial and just put a
placeholder there? So that Knot manages the serial by itself? Knot could then
f.e. look at the timestamp of the zonefile to decide if it needs to update the
zone serial (f.e. unix timestamp) and reload the zone. Are there any other suggestions how to manage
zonefiles in Git when using
DNSSEC? Is it a problem when replacing the zonefile every time with an unsigned
one and let Knot resign the whole zone, or zones, because with a git reset all
zonefiles will be replaced by the original files? Looks like this would cause a
lot of troubles because of the automatic serial increment when signing a zone.
It's not a problem with `unixtime` serial policy.
Setting zonefile-sync to -1 seems not to be a great
idea in production...
Depends on your requirements or workflow. Clearing the journal at every zone update (or
when it grows too much) and restarting the server should work fine (after some testing in
your environment). But then it would be same as `knotc flush <zone> && git
fetch && git checkout HEAD -- <zonefile> && knotc reload`; the zone
would get resigned on every git checkout
Cheers,
--
Ondřej Surý -- Technical Fellow
--------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Milesovska 5, 130 00 Praha 3, Czech Republic
mailto:ondrej.sury@nic.cz https://nic.cz/
--------------------------------------------
General question: How are others managing zonefiles
besides in Git?
Cheers,
Tobias
8 Led
8 Led
14:09
Dne 4.1.2016 v 16:20 Tobias Brunner napsal(a):
General question: How are others managing zonefiles
besides in Git?
I'm still using some scripted dnssec-signzone approach, however, I'm
looking into using the nsdiff[1] utility to compare zonefile presented
by server with a checked out unsigned master zonefile and pipe the
results to the nsupdate utility. That means live zone files can be
completely dynamic, stored somewhere in /var/ and each update changes
only the minimum number of RRs.
[1]: http://dotat.at/prog/nsdiff/
--
Ondřej Caletka
3040
days inactive
3050
days old
9 comments
6 participants
participants (6)
-
Bastien Durel -
Jan Včelák -
Ondřej Caletka -
Ondřej Surý -
Tobias Brunner -
Tore Anderson