<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">would be an excellent "way into dnssec".<div><br></div><div>This wouldn't require any change to the existing (non-dnssec) powerdns setups, and would allow us to test with "real" things, easily migrate single domains to a dnssec setup (just change the nameservers), rollback when needed to the old and tested setup etc.</div><div><br></div><div>Am I correct that this would only work via AXFR style transfers from the non-dnssec pdns to the new pdns-dnssec slaves?</div><div><br></div><div>Frank</div><div><br><div><div>On 06 Jan 2011 wk 1, at 20:00, bert hubert wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>On Thu, Jan 06, 2011 at 11:55:24AM -0500, Mathew Hennessy wrote:<br><blockquote type="cite">Excellent! BTW, can PowerDNSSEC operate in the following way as one would expect:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">PowerDNS supermaster which has DNSSEC RRs but doesn't do DNSSEC (aka<br></blockquote><blockquote type="cite">traditional PowerDNS) providing data to PowerDNS slaves. If you use the<br></blockquote><blockquote type="cite">new code with a compatible backend on the slaves (such as gsqlite3), and<br></blockquote><blockquote type="cite">your whois servers only point to those slaves, will it work?<br></blockquote><br>Almost! If you did that up till just now, you would have had to run 'pdnssec<br>rectify-zone' on your slaves after each AXFR.<br><br>However, thank you for raising this idea, this sounds like a very valid use<br>case.<br><br>It has just been implemented in changeset<br><a href="http://wiki.powerdns.com/trac/changeset/1819">http://wiki.powerdns.com/trac/changeset/1819</a><br><br>I tested it against an ancient server, and now I have a fully<br>operational DNSSEC zone!<br><br>It works fully automatic on retrieving a zone for which we have local keying<br>material.<br><br>In this way, PowerDNSSEC can now be used to 'dnssec-ify' existing data, a<br>bit like 'phreebird'. <a href="http://freshmeat.net/projects/phreebird">http://freshmeat.net/projects/phreebird</a><br><br><span class="Apple-tab-span" style="white-space:pre"> </span>Bert<br><br><blockquote type="cite"><br></blockquote><blockquote type="cite">Thanks,<br></blockquote><blockquote type="cite">= Matt<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">On Jan 6, 2011, at 10:13, bert hubert wrote:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">Dear PowerDNS Community,<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">With the help of many of you, we've now brought 'PowerDNSSEC' to the point<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">where it might make sense for you to trial it on test domains. We expect to<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">make move some of our own important domains over to PowerDNSSEC early next<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">week. <a href="http://PowerDNS.COM">PowerDNS.COM</a> underlies the commercial DNS hosting service 'Express',<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">and may have to wait a bit longer.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">To test, head over to <a href="http://www.powerdnssec.org">http://www.powerdnssec.org</a> (which of course is powered<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">by PowerDNSSEC). More information is on<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><a href="http://wiki.powerdns.com/trac/wiki/PDNSSEC">http://wiki.powerdns.com/trac/wiki/PDNSSEC</a> - including how to get started,<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">and how to get help.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">In brief, PowerDNSSEC will allow you to continue operating as normal in many<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">cases, with only slight changes to your installation. There is no need to<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">run signing tools, nor is there a need to rotate keys or run scripts.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Particularly, if you run with Generic MySQL, Generic PostgreSQL or Generic<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">SQLite3, you should have an easy time. A small schema update is required,<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">plus an invocation of 'pdnssec secure-zone domain-name && pdnssec<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">rectify-zone domain-name' per domain you want to secure. And that should be<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">it.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Supported are:<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* NSEC<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* NSEC3 in ordered mode (pre-hashed records)<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* NSEC3 in narrow mode (unmodified records)<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* Zone transfers (for NSEC)<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* Import of 'standard' private keys from BIND/NSD<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* Export of 'standard' private keys<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* RSASHA1<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* "Pure" PostgreSQL, SQLite3 & MySQL operations<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span class="Apple-tab-span" style="white-space:pre"> </span>* Hybrid BIND/PostgreSQL/SQLite3/MySQL operation<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">To join the fun, download the tarball which can be found on the sites above,<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">and let us know how it works for you!<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">To clarify, we do not recommend taking the current code snapshot into<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">production, but we are getting close.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Kind regards,<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Bert<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">_______________________________________________<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Pdns-users mailing list<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote>_______________________________________________<br>Pdns-users mailing list<br><a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br><a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users">http://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br></div></blockquote></div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: 'Lucida Grande'; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div><br class="Apple-interchange-newline"><br></div><div>Frank<br><div> </div><div><font class="Apple-style-span" size="1"><span class="Apple-style-span" style="font-size: 9px; "><font class="Apple-style-span" color="#A9A9A9">-- </font></span></font></div><div><br><div><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: 'Lucida Grande'; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div><div><b><font class="Apple-style-span" color="#006BAB">Frank Louwers</font></b></div><div><font class="Apple-style-span" color="#747773"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; ">Operations -- Openminds bvba</span></font></font><span class="Apple-tab-span" style="white-space: pre; "><font class="Apple-style-span" color="#747773"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; "> </span></font></font></span><a href="http://www.openminds.be/"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; ">http://openminds.be</span></font></a></div><div><font class="Apple-style-span" color="#747773"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; "><a href="mailto:frank@openminds.be">frank@openminds.be</a></span></font></font><span class="Apple-tab-span" style="white-space: pre; "><font class="Apple-style-span" color="#747773"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; "> </span></font></font></span><font class="Apple-style-span" color="#747773"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; ">+32.9 225 82 91</span></font></font></div><div><font class="Apple-style-span" color="#747773"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; "><br></span></font></font></div><div><font class="Apple-style-span" color="#747773"><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; ">Schrijf je nu in op onze nieuwsbrief: </span></font></font><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px; "><a href="http://www.openminds.be/nieuwsbrief">http://openminds.be/nieuwsbrief</a></span></font></div></div><div><font class="Apple-style-span" size="3"><br></font></div></span></div></div></div></span><br class="Apple-interchange-newline">
</div>
<br></div></body></html>