Hi Håvard,
I also ran into this a couple of times. I "fixed" this by using the
"ods-ksmutil key generate" command.
Regards,
Maurice Mahieu
On 01/28/2016 10:32 AM, Yuri Schaeffer wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Håvard,
For now I made an issue in our tracker for it
https://issues.opendnssec.org/browse/OPENDNSSEC-752
Regards,
Yuri
On 25-01-16 15:35, Havard Eidnes wrote:
Hi,
I had reason to inspect the log from the physical console on our
signer host, and found messages from ods-enforcerd related to two
of our zones:
Jan 24 17:07:01 hugin ods-enforcerd: Error allocating ksks to zone
godegrep.no Jan 24 17:07:16 hugin ods-enforcerd: Error allocating
zsks to zone 2.1.2.6.1.9.3.7.7.4.nrenum.net
and that this is a recurring theme.
Looking at the log reveals a bit more:
Jan 25 14:12:48 hugin ods-enforcerd: Zone godegrep.no found. Jan 25
14:12:48 hugin ods-enforcerd: Policy for godegrep.no set to
default. Jan 25 14:12:48 hugin ods-enforcerd: Config will be output
to /var/opendnssec/signconf/godegrep.no.xml. Jan 25 14:12:48 hugin
ods-enforcerd: Not enough keys to satisfy ksk policy for zone:
godegrep.no. keys_to_allocate(1) = keys_needed(1) -
(keys_available(1) - keys_pending_retirement(1)) Jan 25 14:12:48
hugin ods-enforcerd: Tried to allocate 1 keys, failed on allocating
key number 1 Jan 25 14:12:48 hugin ods-enforcerd: ods-enforcerd
will create some more keys on its next run Jan 25 14:12:48 hugin
ods-enforcerd: Error allocating ksks to zone godegrep.no
It seems to me that the calculation above wrt. keys_to_allocate is
correct, but the statement that ods-enforcerd will create more keys
on its next run appears to be a blatant lie.
Listing the keys for these zones reveals that some of the "Date of
next transition" has come and gone without the transition to the
next state having taken place, and one of the key sets has a key in
"generate" state which isn't visible witout the "-all" switch:
ods @ hugin: {6} ods-ksmutil key list -all --zone godegrep.no
Keys: Zone: Keytype: State: Date
of next transition: godegrep.no KSK
active 2015-12-13 15:12:43 godegrep.no ZSK
retire 2015-12-29 09:45:48 godegrep.no ZSK
active 2016-01-07 04:30:48 godegrep.no ZSK
generate (not scheduled)
ods @ hugin: {7} ods-ksmutil key list --all --zone
2.1.2.6.1.9.3.7.7.4.nrenum.net Keys: Zone:
Keytype: State: Date of next transition:
2.1.2.6.1.9.3.7.7.4.nrenum.net KSK active 2016-12-09
23:42:31 2.1.2.6.1.9.3.7.7.4.nrenum.net ZSK active
2016-01-06 00:25:00
ods @ hugin: {8}
I'm not sure when this started.
So...
1) Any idea how OpenDNSSEC got itself into this state?
2) Are there any manual steps I have to perform to get it out of
this state for these two zones?
3) Rhetorical: why doesn't OpenDNSSEC recover by itself from this?
Best regards,
- Håvard _______________________________________________
Opendnssec-user mailing list [email protected]
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iEYEARECAAYFAlap4BMACgkQI3PTR4mhaviRvgCgoYBMVUFAMkjqDZ/ster8n5G5
MwoAoL8HgOSsNoeCD1Dpg+PGzi+TGizc
=pWOH
-----END PGP SIGNATURE-----
_______________________________________________
Opendnssec-user mailing list
[email protected]
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
--
Maurice Mahieu
System Engineer | [email protected] <mailto:[email protected]> | +31 (0)20
53 09 111 <tel:+31205309111>
info.nl <http://www.info.nl> /making platforms work/
<http://www.info.nl/nl?utm_source=e-mail_sig&utm_medium=e-mail&utm_term=connecting_the_dots&utm_campaign=info_sig>
Sint Antoniesbreestraat 16 | 1011 HB Amsterdam | +31 (0)20 530 91 00
<tel:+31205309100>
Facebook <https://www.facebook.com/infonl> | Twitter
<https://twitter.com/infonl> | LinkedIn
<https://www.linkedin.com/company/info.nl> | Google+
<https://plus.google.com/+infonl/>
_______________________________________________
Opendnssec-user mailing list
[email protected]
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
