8 Bře
2022
8 Bře
'22
16:23
Running 5.4.4, adding an NTA seems very straightforward:-
What is the precise incantation to remove it when it is no longer required?
The following do not work:-
Any help would be appreciated.
Also, does Knot Resolver allow an automatic timeout when setting NTAs as
Bind does?
---
Best wishes,
Matthew
trust_anchors.set_insecure( {"fj"} )
trust_anchors.summary()
'fj. is
negative trust anchor
. 172800 DNSKEY 257 3 8
AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
; Valid: ; KeyTag:20326
'
trust_anchors.remove('fj')
false
trust_anchors.remove('fj.')
false
trust_anchors.remove( {"fj"} )
false 
8 Bře
8 Bře
17:40
On 08/03/2022 16.23, Matthew Richardson wrote:
Running 5.4.4, adding an NTA seems very
straightforward:-
[...]
What is the precise incantation to remove it when it is no longer required?
The following do not work:
The .set_insecure function *replaces* the NTA set. And naturally, the
question only matters if you're doing dynamic reconfiguration. Usually
people just restart the service to get new config, I assume. Anything
unclear in the docs?
https://knot-resolver.readthedocs.io/en/stable/config-dnssec.html#trust_anc…
Also, does Knot Resolver allow an automatic timeout
when setting NTAs as
Bind does?
No, currently it doesn't.
--Vladimir
18:43
Vladimír ?unát <vladimir.cunat(a)nic.cz> wrote:-
On 08/03/2022 16.23, Matthew Richardson wrote:
Thank you for your helpful explanation, the key (which despite studying I
had not noticed, but which IS clearly written in the fine docs) being
*replaces*. Thus, if one wants to do things dynamically:-
Running 5.4.4, adding an NTA seems very
straightforward:-
[...]
What is the precise incantation to remove it when it is no longer required?
The following do not work:
The .set_insecure function *replaces* the NTA set. And naturally, the
question only matters if you're doing dynamic reconfiguration. Usually
people just restart the service to get new config, I assume. Anything
unclear in the docs?
https://knot-resolver.readthedocs.io/en/stable/config-dnssec.html#trust_anc…
> trust_anchors.set_insecure( { } )
does *replace* the NTAs with no NTAs. A restart may be an easier solution.
--
Best wishes,
Matthew
788
days inactive
788
days old
knot-resolver-users@lists.nic.cz
2 comments
2 participants
participants (2)
-
Matthew Richardson -
Vladimír Čunát