FIPS 140-3 mode on RHEL 9 and RSA validation of <2048 keys

Hello, I have sent already a notification about SHA-1 not validated in default configuration. However that was not end of the story. A new and even more severe issue has arisen. Our crypto team is responsible for preparing RHEL 9 for FIPS 140-3 certification. They said there is legal obligation t

Re: FIPS 140-3 mode on RHEL 9 and RSA validation of <2048 keys

Forgot to add the bug link. - openssl: https://bugzilla.redhat.com/show_bug.cgi?id=2077884 - bind: https://bugzilla.redhat.com/show_bug.cgi?id=2077906 On 4/25/22 11:39, Petr Menšík wrote: > Hello, > > I have sent already a notification about SHA-1 not validated in default > configuration. However

Re: FIPS 140-3 mode on RHEL 9 and RSA validation of <2048 keys

On 25. 04. 22 11:49, Petr Menšík wrote: Forgot to add the bug link. - openssl: https://bugzilla.redhat.com/show_bug.cgi?id=2077884 - bind: https://bugzilla.redhat.com/show_bug.cgi?id=2077906 On 4/25/22 11:39, Petr Menšík wrote: Hello, I have sent already a notification about SHA-1 not validat

Building contrib modules for 9.18.2 fails

Hi, I'm trying to build bind 9.18.2 with the contrib modules, but this fails for contrib/dlz/modules/wildcard. Without any modifications to the spec file used for 9.18.1, it fails because it does not have "FALLTHROUGH" and "UNREACHABLE()", whose use is new in 9.18.2, defined. I tried to so

test, please ignore

Thanks, subject is all. -- Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielMahoneyIV LI: linkedin.com/in/gushi Site: http://www.gushi.org --- -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscrib

testing, please ignore

Sorry for the noise -- -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lis

Testing, please ignore

Testing, please ignore. -Dan -- -- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bin

DNSSEC

Any easy repices to get your domains DNSSEC compilant? -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b

Re: DNSSEC

On 04/25/2022 8:31 am, The Doctor via bind-users wrote: Any easy repices to get your domains DNSSEC compilant? -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 a

getting answers from DNS queries

I asked this last week, but I didn't an answer. Who can I tell if a DNS query is refused or answered? Is it in the log files? Can a compile-time option help me access it? Sorry to repeat but I really need to know this. Thank in advance. -- Hal King - h...@utk.edu Systems Administrator Office

Re: getting answers from DNS queries

> I asked this last week, but I didn't an answer. Probably because I still don’t know what you mean. You need to better articulate your problem and your question. Ondrej -- Ondřej Surý (He/Him) ond...@isc.org My working hours and your working hours may be different. Please do not feel obligated

Re: getting answers from DNS queries

> > I asked this last week, but I didn't an answer. Who can I tell if a DNS > query is refused or answered? Is it in the log files? Can a compile-time > option help me access it? Sorry to repeat but I really need to know this. > > Thank in advance. > Hi Hal, I saw at least one reply to your query

Re: getting answers from DNS queries

That's fair. I can see queries come into my DNS server, but I can't find answers to thoughts queries. I have an RPZ zone and I get a log file that says PASSTHROUGH or NXDOMAIN. That tells me that the request was served or denied. I want something that will tell me the answer to each query. I hav

Re: getting answers from DNS queries

That’s much better - you should search for dnstap, initial pointer might be: https://kb.isc.org/docs/aa-01342 Ondrej -- Ondřej Surý (He/Him) ond...@isc.org My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours. > On 25

Re: getting answers from DNS queries

More specificity would help. OTOH you mentioned the word "compile"... On Mon, 25 Apr 2022, King, Harold Clyde (Hal) via bind-users wrote: I asked this last week, but I didn't an answer. Who can I tell if a DNS query is refused or answered? Is it in the log files? Not the latest version of BIND

Re: dnssec-policy makes BIND touch all key files every hour

On Sun, Apr 24, 2022 at 11:58:44AM +0200, Bjørn Mork wrote: Hello, > I recently moved a few zones from "auto-dnssec maintain" to > "dnssec-policy ..." to prepare for simpler/automatic key rotation in the > future. > > For the time being I have configured my policy with separate KSK and ZSK > and