Hi,
we're using knot as a bump-in-the-wire DNSSEC Signer. The setup is as
follows:
BIND9(unsigned) -> AXFR -> knot(signing) -> AXFR -> BIND9(signed)
The zone starts out with a low serial like 10 or 11. knot has a
serial-policy: unixtime for the zones.
Problem is, whenever an update is pushed the serial number is
decreased again from unixtime back to the original serial which
prevents the zone from propagating to the slaves.
Example (test zone):
template:
- id: slave-dnssec-ecdsap256
storage: "/var/lib/knot/slave"
file: "%s.zone"
zonefile-load: difference
dnssec-signing: on
dnssec-policy: ecdsap256
master: ns1_signer
notify: ns1
acl: acl_ns1
zone:
- domain: xn--78jubwhb.xn--q9jyb4c
template: slave-dnssec-ecdsap256
serial-policy: unixtime
Here is an example where first a manual "zone-sign" is done to update
the serial to current unixtime (12 -> 1559298292) and after that the
zone is transferred in again which results in a serial decrease
(1559298292 -> 13).
[xn--78jubwhb.xn--q9jyb4c.] control, received command 'zone-sign'
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, dropping previous signatures, re-signing
zone
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, key, tag 49852, algorithm ECDSAP256SHA256,
KSK, public, active
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, key, tag 55142, algorithm ECDSAP256SHA256,
public, active
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, signing started
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, successfully signed
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, next signing at 2019-06-07T12:24:52
[xn--78jubwhb.xn--q9jyb4c.] zone file updated, serial 12 -> 1559298292
[xn--78jubwhb.xn--q9jyb4c.] notify, outgoing, remote 176.9.75.248@53, serial
1559298292
[xn--78jubwhb.xn--q9jyb4c.] AXFR, outgoing, remote 176.9.75.248@60025, started,
serial 1559298292
[xn--78jubwhb.xn--q9jyb4c.] AXFR, outgoing, remote 176.9.75.248@60025,
finished, 0.00 seconds, 1 messages, 1819 bytes
[xn--78jubwhb.xn--q9jyb4c.] notify, incoming, remote 176.9.75.248@9104,
received, serial 13
[xn--78jubwhb.xn--q9jyb4c.] refresh, remote 176.9.75.248@53, remote serial 13,
zone is outdated
[xn--78jubwhb.xn--q9jyb4c.] IXFR, incoming, remote 176.9.75.248@53, receiving
AXFR-style IXFR
[xn--78jubwhb.xn--q9jyb4c.] AXFR, incoming, remote 176.9.75.248@53, starting
[xn--78jubwhb.xn--q9jyb4c.] AXFR, incoming, remote 176.9.75.248@53, finished,
0.00 seconds, 1 messages, 321 bytes
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, key, tag 49852, algorithm ECDSAP256SHA256,
KSK, public, active
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, key, tag 55142, algorithm ECDSAP256SHA256,
public, active
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, signing started
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, successfully signed
[xn--78jubwhb.xn--q9jyb4c.] DNSSEC, next signing at 2019-06-07T12:25:21
[xn--78jubwhb.xn--q9jyb4c.] refresh, remote 176.9.75.248@53, zone updated, 0.10
seconds, serial 12 -> 13
[xn--78jubwhb.xn--q9jyb4c.] zone file updated, serial 1559298292 -> 13
[xn--78jubwhb.xn--q9jyb4c.] notify, outgoing, remote 176.9.75.248@53, serial 13
How to prevent this? We want knot to always use the current unixtime
for the zone.
Best Regards
Sebastian
--
GPG Key: 0x58A2D94A93A0B9CE (F4F6 B1A3 866B 26E9 450A 9D82 58A2 D94A 93A0 B9CE)
'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE.
-- Terry Pratchett, The Fifth Elephant
--
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
