Hi Daniel, works as it should, thanks!
Thomas On 20.03.19 20:58, [email protected] wrote: > Hi Thomas, > > I don't think that simple backup using rsync is safe. In general, > Knot DNS manages up to 4 LMDB databases (confdb, journal, timers, and > kaspdb). > You should backup these databases using proper commands. > See > https://www.knot-dns.cz/docs/2.8/singlehtml/index.html#export-import-kasp-db > > Probably you don't have to backup journal and timers. > > Daniel > > On 2019-03-20 13:48, Thomas E. wrote: >> Hi! >> >> We've been experimenting with backups and disaster recovery in our >> knot test setup and have been running into a weird issue. >> >> Basically our backup strategy right now is to perform incremental >> backups of the /var/lib/knot and the /etc/knot directories via rsync. >> >> When we try to restore these backups knot starts successfully, but >> logs the following messages for each of the zones that are currently >> in a signed template: >> >> 2019-03-08T11:43:05 info: [example.com.] DNSSEC, signing zone >> 2019-03-08T11:43:05 error: [example.com.] zone event 'DNSSEC re-sign' >> failed (invalid parameter) >> >> When we try to query information about these zones via dig we receive >> a SERVFAIL rcode for them. >> >> All of the zones that are not processed through the DNSSEC mechanism >> are unaffected by this. >> >> We also experienced th same behavior, when we were experimenting with >> adding new zones that are signed immediately. >> >> To workaround this problem we currently add the zone in an unsigned >> state (aka default template) to knot and after that we switch the >> template of the zone to "signed". >> >> This works like a charm for new zones and can also be used to recover >> each of the broken zones after restoring the backup, but we'd rather >> not use this workaround during disaster recovery as it would impose >> the danger of breaking the zones if it is not performed correctly. >> >> The templates and policies in our knot.conf look like this right now: >> >> policy: >> - id: shared >> algorithm: RSASHA256 >> ksk-size: 2048 >> zsk-size: 1024 >> zsk-lifetime: 1d >> ksk-lifetime: 2d >> ksk-shared: true >> ksk-submission: resolver >> nsec3: true >> cds-cdnskey-publish: always >> >> template: >> - id: default >> storage: "/var/lib/knot" >> semantic-checks: on >> global-module: mod-stats >> master: primary >> notify: secondaries >> acl: [primary, secondaries] >> serial-policy: unixtime >> dnssec-signing: off >> >> - id: signed >> dnssec-signing: on >> dnssec-policy: shared >> master: primary >> notify: secondaries >> acl: [primary, secondaries] >> serial-policy: unixtime >> >> zone: >> - domain: example.com >> template: signed >> >> >> Thanks, >> Thomas -- https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
