Comment on Bind 9.18.18 dnssec key location and privileges?
TheInsane42@lemmy.world 11 months ago
You need to include the files in the zone file. Bind 9.18.18 is a mess with the changed DNSSEC setup, it broke my domains as well. I’t isn the bind documentation, so I have to refer you there. I have no access to my setup now (or my browser history) as I’m not at my computer.
tburkhol@lemmy.world 11 months ago
I’d tried that…this has been going on for five days, and I can not describe my level of frustration. But I solved it, literally just now.
Despite
systemctl status apparmor.service
claiming it was inactive, it was secretly active. audit.log was so full of sudo that I failed to see all of theThat made me realize, when I thought I fixed the apparmor rule, I’d used
/etc/bind/dnskey/ rw
instead of/etc/bind/dnskey/** rw
The bind manual claims that you don’t need to manually create keys or manually include them in your zone file, if you use
dnssec-policy default
or presumably any other policy with inline-signing. Claims that bind will generate its own keys, write them, and even manage timed rotation or migration to a new policy. I can’t confirm or deny that, because it definitely found the keys I had manually created (one of which was $INCLUDEd in the zone file, and one not) and used them. It also edited them and created .state files.I feel like I should take the rest of the day off and celebrate.
TheInsane42@lemmy.world 11 months ago
Sorry, totally forgot apparmor. On debian that thing can be nasty, I had to fix those rules as well for bind That was years ago and was added to my Puppet module, so I forgot.