22 Srp
2022
22 Srp
'22
15:44
Hello,
I tried to upgrade to knot 3.2 using the debian packages
from https://deb.knot-dns.cz/knot-latest bullseye/main, but the server
does not use my HSM anymore. All zones fails with :
août 22 14:38:13 arrakeen knotd[1285865]: info: [durel.org.] zone file parsed, serial
2021120479
août 22 14:38:13 arrakeen knotd[1285865]: error: [durel.org.] DNSSEC, failed to initialize
signing context (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: 2022-08-22T14:38:13+0200 error: [durel.org.]
DNSSEC, failed to initialize signing context (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: 2022-08-22T14:38:13+0200 error: [durel.org.]
zone event 'load' failed (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: error: [durel.org.] zone event 'load'
failed (PKCS #11 token not available)
debug log does not seems to print more details about error
keystore is defined as :
keystore:
- id: hsmkey
backend: pkcs11
config: "pkcs11:pin-value=REDACTED
/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so"
The HSM itself is an USB key from CardContact.de
Downgrading to 3.1.9-cznic.1~bullseye re-enable signing
Is there anything I can do to debug/solves this problem ?
Regards,
--
Bastien
22 Srp
22 Srp
15:55
Hi Bastien,
I'm sorry for the issues! Currently we aren't aware of any change which could
affect that.
We have been investigating that.
Daniel
On 22. 08. 22 15:44, Bastien Durel wrote:
Hello,
I tried to upgrade to knot 3.2 using the debian packages
from https://deb.knot-dns.cz/knot-latest bullseye/main, but the server
does not use my HSM anymore. All zones fails with :
août 22 14:38:13 arrakeen knotd[1285865]: info: [durel.org.] zone file parsed, serial
2021120479
août 22 14:38:13 arrakeen knotd[1285865]: error: [durel.org.] DNSSEC, failed to
initialize signing context (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: 2022-08-22T14:38:13+0200 error: [durel.org.]
DNSSEC, failed to initialize signing context (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: 2022-08-22T14:38:13+0200 error: [durel.org.]
zone event 'load' failed (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: error: [durel.org.] zone event 'load'
failed (PKCS #11 token not available)
debug log does not seems to print more details about error
keystore is defined as :
keystore:
- id: hsmkey
backend: pkcs11
config: "pkcs11:pin-value=REDACTED
/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so"
The HSM itself is an USB key from CardContact.de
Downgrading to 3.1.9-cznic.1~bullseye re-enable signing
Is there anything I can do to debug/solves this problem ?
Regards,
16:18
Bastien,
Are you sure that the same configuration is used? The error can only arise when opening a
PKCS #11 token
and it only depends on the configuration.
Daniel
On 22. 08. 22 15:55, Daniel Salzman wrote:
Hi Bastien,
I'm sorry for the issues! Currently we aren't aware of any change which could
affect that.
We have been investigating that.
Daniel
On 22. 08. 22 15:44, Bastien Durel wrote:
Hello,
I tried to upgrade to knot 3.2 using the debian packages
from https://deb.knot-dns.cz/knot-latest bullseye/main, but the server
does not use my HSM anymore. All zones fails with :
août 22 14:38:13 arrakeen knotd[1285865]: info: [durel.org.] zone file parsed, serial
2021120479
août 22 14:38:13 arrakeen knotd[1285865]: error: [durel.org.] DNSSEC, failed to
initialize signing context (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: 2022-08-22T14:38:13+0200 error: [durel.org.]
DNSSEC, failed to initialize signing context (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: 2022-08-22T14:38:13+0200 error: [durel.org.]
zone event 'load' failed (PKCS #11 token not available)
août 22 14:38:13 arrakeen knotd[1285865]: error: [durel.org.] zone event 'load'
failed (PKCS #11 token not available)
debug log does not seems to print more details about error
keystore is defined as :
keystore:
- id: hsmkey
backend: pkcs11
config: "pkcs11:pin-value=REDACTED
/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so"
The HSM itself is an USB key from CardContact.de
Downgrading to 3.1.9-cznic.1~bullseye re-enable signing
Is there anything I can do to debug/solves this problem ?
Regards,
--
16:23
Le lundi 22 août 2022 à 16:18 +0200, Daniel Salzman a écrit :
Bastien,
Are you sure that the same configuration is used? The error can only
arise when opening a PKCS #11 token
and it only depends on the configuration.
Hello,
Yes, I upgraded the package, and restarted the service without changing
the configuration file. Then checked the logs to make sure there were
no error, and find out there were many of them.
Regards,
--
Bastien
23 Srp
23 Srp
7:38
Bastien,
I suspect it's related to systemd service changes (main commit
https://gitlab.nic.cz/knot/knot-dns/-/commit/e152a4c21e0f34bece12eb68af61e5…).
Especially the TemporaryFileSystem setting. You can try extending it with some /usr value.
I will try to reproduce the issue using softhsm.
Daniel
On 8/22/22 16:23, Bastien Durel wrote:
Le lundi 22 août 2022 à 16:18 +0200, Daniel Salzman a
écrit :
Bastien,
Are you sure that the same configuration is used? The error can only
arise when opening a PKCS #11 token
and it only depends on the configuration.
Hello,
Yes, I upgraded the package, and restarted the service without changing
the configuration file. Then checked the logs to make sure there were
no error, and find out there were many of them.
Regards,
10:10
Le mardi 23 août 2022 à 07:38 +0200, Daniel Salzman a écrit :
Bastien,
I suspect it's related to systemd service changes (main commit
https://gitlab.nic.cz/knot/knot-dns/-/commit/e152a4c21e0f34bece12eb68af61e5…
).
Especially the TemporaryFileSystem setting. You can try extending it
with some /usr value. I will try to reproduce the issue using
softhsm.
Daniel
Hello,
I can confirm removing the line "TemporaryFileSystem=/run:ro /var:ro"
from unit make knot able to use the HSM key
As /usr is not listed, it should be left untouched in the FS namespace,
I'll try to dig a little bit more
Regards,
--
Bastien
11:03
Le mardi 23 août 2022 à 10:10 +0200, Bastien Durel a écrit :
Le mardi 23 août 2022 à 07:38 +0200, Daniel Salzman a
écrit :
I've straced the culprit :
1450856 stat("/run/pcscd/pcscd.comm", 0x7fb2a6a61b20) = -1 ENOENT (No such file
or directory)
With the given override, it works :
# /etc/systemd/system/knot.service.d/override.conf
[Service]
BindPaths=/run/pcscd
Hiding /run may be a little bit too strict ? The opensc-pkcs11 reads
the /run/pcscd/pcscd.comm socket, maybe other pkcs#11 modules uses
other files ?
Regards,
--
Bastien
Bastien,
I suspect it's related to systemd service changes (main commit
https://gitlab.nic.cz/knot/knot-dns/-/commit/e152a4c21e0f34bece12eb68af61e5…
).
Especially the TemporaryFileSystem setting. You can try extending
it
with some /usr value. I will try to reproduce the issue using
softhsm.
Daniel
Hello,
I can confirm removing the line "TemporaryFileSystem=/run:ro /var:ro"
from unit make knot able to use the HSM key
As /usr is not listed, it should be left untouched in the FS
namespace,
I'll try to dig a little bit more
14:12
Bastien,
We propose this change
https://gitlab.nic.cz/knot/knot-dns/-/commit/5337b5e9e09919f619c655575c8d71…
Are you ok with that?
Daniel
On 8/23/22 11:03, Bastien Durel wrote:
Le mardi 23 août 2022 à 10:10 +0200, Bastien Durel a
écrit :
Le mardi 23 août 2022 à 07:38 +0200, Daniel
Salzman a écrit :
I've straced the culprit :
1450856 stat("/run/pcscd/pcscd.comm", 0x7fb2a6a61b20) = -1 ENOENT (No such file
or directory)
With the given override, it works :
# /etc/systemd/system/knot.service.d/override.conf
[Service]
BindPaths=/run/pcscd
Hiding /run may be a little bit too strict ? The opensc-pkcs11 reads
the /run/pcscd/pcscd.comm socket, maybe other pkcs#11 modules uses
other files ?
Regards,
Bastien,
I suspect it's related to systemd service changes (main commit
https://gitlab.nic.cz/knot/knot-dns/-/commit/e152a4c21e0f34bece12eb68af61e5…
).
Especially the TemporaryFileSystem setting. You can try extending
it
with some /usr value. I will try to reproduce the issue using
softhsm.
Daniel
Hello,
I can confirm removing the line "TemporaryFileSystem=/run:ro /var:ro"
from unit make knot able to use the HSM key
As /usr is not listed, it should be left untouched in the FS
namespace,
I'll try to dig a little bit more
14:51
Le 23/08/2022 à 14:12, Daniel Salzman a écrit :
Bastien,
We propose this change
https://gitlab.nic.cz/knot/knot-dns/-/commit/5337b5e9e09919f619c655575c8d71…
Are you ok with that?
Hello,
Yes, this will works too
Regards,
--
Bastien Durel
19:38
Bastien,
You can find fixed packages (3.2.0-cznic.2) in our repositories soon.
Daniel
On 8/23/22 14:51, Bastien Durel wrote:
Le 23/08/2022 à 14:12, Daniel Salzman a écrit :
Bastien,
We propose this change
https://gitlab.nic.cz/knot/knot-dns/-/commit/5337b5e9e09919f619c655575c8d71…
Are you ok with that?
Hello,
Yes, this will works too
Regards,
635
days inactive
636
days old
9 comments
2 participants
participants (2)
-
Bastien Durel -
Daniel Salzman