Date: Sat, 13 Oct 2018 14:31:48 +0700 From: Eugene Grosbein <eugen@grosbein.net> To: =?UTF-8?Q?Dag-Erling_Sm=c3=b8rgrav?= <des@des.no> Cc: freebsd-net <freebsd-net@freebsd.org> Subject: Re: DNS KSK rollover, local_unbound and 11.2-STABLE Message-ID: <20be8009-5de8-61f0-dc67-a6b18af7bc37@grosbein.net> In-Reply-To: <861s8uaodn.fsf@next.des.no> References: <5BC046FB.9080906@grosbein.net> <861s8uaodn.fsf@next.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
13.10.2018 3:41, Dag-Erling Smørgrav wrote:
> In any case, if unbound-anchor is unable to get and validate the KSK, it
> will fall back to getting it over http (using an unvalidated DNS lookup)
> and verifying the accompanying signature against a hardcoded x509
> certificate which is valid until 2023.
>
> DES
>
There is something strange happening. The commands "unbound-anchor -vv; cat /var/unbound/root.key" show:
[skip]
success: the anchor has been updated using the cert
; created by unbound-anchor on Sat Oct 13 14:28:12 2018
. IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5
. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
Several seconds later, "cat /var/unbound/root.key" shows:
; autotrust trust anchor file
;;id: . 1
;;last_queried: 1539415747 ;;Sat Oct 13 14:29:07 2018
;;last_success: 1451318744 ;;Mon Dec 28 23:05:44 2015
;;next_probe_time: 1539423230 ;;Sat Oct 13 16:33:50 2018
;;query_failed: 2
;;query_interval: 43200
;;retry_time: 8640
. 172800 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=1448912140 ;;Tue Dec 1 02:35:40 2015
It seems, distinct processes update the file and one of them fails.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20be8009-5de8-61f0-dc67-a6b18af7bc37>