Hi Thomas,
I don't think that simple backup using rsync is safe. In general,
Knot DNS manages up to 4 LMDB databases (confdb, journal, timers, and
kaspdb).
You should backup these databases using proper commands.
See
https://www.knot-dns.cz/docs/2.8/singlehtml/index.html#export-import-kasp-db
Probably you don't have to backup journal and timers.
Daniel
On 2019-03-20 13:48, Thomas E. wrote:
Hi!
We've been experimenting with backups and disaster recovery in our
knot test setup and have been running into a weird issue.
Basically our backup strategy right now is to perform incremental
backups of the /var/lib/knot and the /etc/knot directories via rsync.
When we try to restore these backups knot starts successfully, but
logs the following messages for each of the zones that are currently
in a signed template:
2019-03-08T11:43:05 info: [example.com.] DNSSEC, signing zone
2019-03-08T11:43:05 error: [example.com.] zone event 'DNSSEC re-sign'
failed (invalid parameter)
When we try to query information about these zones via dig we receive
a SERVFAIL rcode for them.
All of the zones that are not processed through the DNSSEC mechanism
are unaffected by this.
We also experienced th same behavior, when we were experimenting with
adding new zones that are signed immediately.
To workaround this problem we currently add the zone in an unsigned
state (aka default template) to knot and after that we switch the
template of the zone to "signed".
This works like a charm for new zones and can also be used to recover
each of the broken zones after restoring the backup, but we'd rather
not use this workaround during disaster recovery as it would impose
the danger of breaking the zones if it is not performed correctly.
The templates and policies in our knot.conf look like this right now:
policy:
- id: shared
algorithm: RSASHA256
ksk-size: 2048
zsk-size: 1024
zsk-lifetime: 1d
ksk-lifetime: 2d
ksk-shared: true
ksk-submission: resolver
nsec3: true
cds-cdnskey-publish: always
template:
- id: default
storage: "/var/lib/knot"
semantic-checks: on
global-module: mod-stats
master: primary
notify: secondaries
acl: [primary, secondaries]
serial-policy: unixtime
dnssec-signing: off
- id: signed
dnssec-signing: on
dnssec-policy: shared
master: primary
notify: secondaries
acl: [primary, secondaries]
serial-policy: unixtime
zone:
- domain: example.com
template: signed
Thanks,
Thomas
--
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
