> On 7 Mar 2018, at 3:48 am, Tony Finch wrote:
>
> Prof. Dr. Michael Schefczyk wrote:
>>
>> The issue is that normal permissions in the key-directory are root:bind
>> 0644 for the public key and root:bind 0600 for the private key. The
>> issue disappears when setting the private key to 0644 al
Prof. Dr. Michael Schefczyk wrote:
>
> The issue is that normal permissions in the key-directory are root:bind
> 0644 for the public key and root:bind 0600 for the private key. The
> issue disappears when setting the private key to 0644 also and that must
> be done before starting bind - before us
: DNSSEC and nsupdate
Setting the permissions of a *private* key to 0644 sounds like a bad idea.
Maybe you mean 0640?
On Fri, 2 Mar 2018 23:28:28 +
"Prof. Dr. Michael Schefczyk" wrote:
> Dear Mark,
>
> I did get the issue resolved while setting up a test environment.
>
.com.hosts";
> update-policy { grant nsupdate zonesub TXT; };
> key-directory "/var/lib/bind";
> auto-dnssec maintain;
> };
>
> Regards,
>
> Michael Schefczyk
>
> -Ursprüngliche Nachricht-
> Von: Mark Andrews [mailto:ma...@is
key-directory "/var/lib/bind";
auto-dnssec maintain;
};
Regards,
Michael Schefczyk
-Ursprüngliche Nachricht-
Von: Mark Andrews [mailto:ma...@isc.org]
Gesendet: Montag, 26. Februar 2018 01:57
An: Prof. Dr. Michael Schefczyk
Cc: bind-users@lists.isc.org
Be
> On 26 Feb 2018, at 8:12 am, Prof. Dr. Michael Schefczyk
> wrote:
>
> Dear Mark,
>
> Thank you very much! No, chroot is not involved. Package debootstrap
> (required for chroot as far as I understand) is not even installed.
>
> It would be great to understand, what the error message:
>
> w
Dear Mark,
Thank you very much! No, chroot is not involved. Package debootstrap (required
for chroot as far as I understand) is not even installed.
It would be great to understand, what the error message:
warning: dns_dnssec_findzonekeys2: error reading private key file
fqdn/ECDSAP384SHA384/41
Are you running chrooted? Did you make the keys visible in the chroot area?
> On 25 Feb 2018, at 2:37 am, Prof. Dr. Michael Schefczyk
> wrote:
>
> Dear All,
>
> For a long time already, I am using a bind master DNS server based on debian
> set up via webmin. It is currently Debian Stretch wi
Dear All,
For a long time already, I am using a bind master DNS server based on debian
set up via webmin. It is currently Debian Stretch with bind 9.10. I am using
DNSSEC.
The webmin setup leads to all keys being stored in /var/lib/bind. The naming
scheme is K[fqdn]+number+keyid.key or .priva
9 matches
Mail list logo
