<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.E-MailFormatvorlage18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.E-MailFormatvorlage19
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE-AT" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US">PowerDNS signature validity is always 3 weeks. Start is the second last Thursday 00:00 UTC, end is the next but one Thursday 00:00.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US">Start End<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US">Thursday Thursday Today Thursday Thursday<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US">00:00 00:00 00:00 00:00<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US">Signatures are calculated "on the fly" for every response sent out. To have more or less "static" signatures the above algorithm is used.
Thursday 00:00 is the beginning of the Linux epoch. Hence, every "epoch-week" the signature lifetimes are changed.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US">regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US">Klaus<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Courier New";color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Von:</span></b><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Pdns-users <pdns-users-bounces@mailman.powerdns.com>
<b>Im Auftrag von </b>Alexander Varejão via Pdns-users<br>
<b>Gesendet:</b> Dienstag, 29. März 2022 22:33<br>
<b>An:</b> pdns-users@mailman.powerdns.com<br>
<b>Betreff:</b> [Pdns-users] RRSIG validity period<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Dears,<br>
<br>
Well, as I said before, I'm new to PowerDNS and I have some doubts about how it works.<br>
<br>
In my tests I'm using three virtual machines:<br>
- One authoritative with mysql backend<br>
- Two Secundaries with sqlite3 backend<br>
<br>
I'm confused about validity period of RRSIGs, could someone help me about it?<br>
<br>
So, my primary Server has the following configuration:<br>
<br>
/etc/powerdns/pdns.conf<br>
<br>
-----------------------------------------------<br>
allow-axfr-ips=ONE SECONDARY IP HERE,OTHER SECONDARY IP HERE<br>
disable-axfr=no<br>
master=yes<br>
include-dir=/etc/powerdns/pdns.d<br>
launch=<br>
security-poll-suffix=<br>
setgid=pdns<br>
setuid=pdns<br>
-----------------------------------------------<br>
<br>
/etc/powerdns/pdns.d/pdns.local.gmysql.conf<br>
<br>
-----------------------------------------------<br>
# MySQL Configuration<br>
#<br>
# Launch gmysql backend<br>
launch+=gmysql<br>
<br>
# gmysql parameters<br>
gmysql-host="PRIMARY IP"<br>
gmysql-port=3306<br>
gmysql-dbname=powerdns<br>
gmysql-user=powerdns<br>
gmysql-password=PASSWORD HERE<br>
gmysql-dnssec=yes<br>
# gmysql-socket=<br>
-----------------------------------------------<br>
<br>
And my Secundary Servers have the following configuration<br>
<br>
/etc/powerdns/pdns.conf<br>
<br>
-----------------------------------------------<br>
slave=yes<br>
slave-cycle-interval=60<br>
include-dir=/etc/powerdns/pdns.d<br>
launch=<br>
security-poll-suffix=<br>
setgid=pdns<br>
setuid=pdns<br>
-----------------------------------------------<br>
<br>
/etc/powerdns/pdns.d/pdns.local.gsqlite.conf<br>
<br>
-----------------------------------------------<br>
# SQLITE3 Configuration<br>
#<br>
# Launch gmysql backend<br>
launch+=gsqlite3<br>
<br>
# gsqlite3 parameters<br>
<br>
gsqlite3-database=/var/lib/pdns/powerdns.db<br>
setuid=pdns<br>
setgid=pdns<br>
gsqlite3-dnssec=yes<br>
-----------------------------------------------<br>
<br>
I created a fake zone "<a href="http://strangeword.com">strangeword.com</a>" and I sign it. On my primary server I ran the following commands<br>
<br>
pdnsutil secure-zone <a href="http://strangeworld.net">strangeworld.net</a><br>
<br>
pdnsutil increase-serial <a href="http://strangeworld.net">strangeworld.net</a><br>
<br>
pdns_control notify <a href="http://strangeworld.net">strangeworld.net</a><br>
<br>
And running 'pdnsutil show-zone' it seems ok to me<br>
<br>
pdnsutil show-zone <a href="http://strangeworld.net">strangeworld.net</a><br>
<br>
Mar 29 20:03:57 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed<br>
This is a Native zone<br>
Metadata items: None<br>
Zone has NSEC semantics<br>
keys: <br>
ID = 3 (CSK), flags = 257, tag = 14784, algo = 13, bits = 256 Active Published ( ECDSAP256SHA256 )
<br>
CSK DNSKEY = <a href="http://strangeworld.net">strangeworld.net</a>. IN DNSKEY 257 3 13 SnJ1JrZ7wiJ8tQKxEWMlAHfVk6lB90bx8G1J8/t+hQ5iPcdssqRj7YJ7IaXVysyaOCPjQZcNZSCIxSMqqQUFEA== ; ( ECDSAP256SHA256 )<br>
DS = <a href="http://strangeworld.net">strangeworld.net</a>. IN DS 14784 13 1 64cbfe2b545ed890a4c2b22a22c4ba76e2b211be ; ( SHA1 digest )<br>
DS = <a href="http://strangeworld.net">strangeworld.net</a>. IN DS 14784 13 2 edf9017ee79e36e0ecf144e63ddb8202b00e6fda58f94244a6def11f63ebcfa7 ; ( SHA256 digest )<br>
DS = <a href="http://strangeworld.net">strangeworld.net</a>. IN DS 14784 13 4 60e7511e17f9841e4bdfc263140d9b800df09b08380f33797fe1213323a71666df5d630bb63eb2ce8532eadf86f52e59 ; ( SHA-384 digest )<br>
<br>
A few weeks later I created new fake zones and running 'pdnsutil show-zone' it seems ok to me too.<br>
<br>
pdnsutil show-zone <a href="http://anotherlife.net">anotherlife.net</a><br>
<br>
Mar 29 20:06:23 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed<br>
This is a Native zone<br>
Metadata items: None<br>
Zone has NSEC semantics<br>
keys: <br>
ID = 15 (CSK), flags = 257, tag = 54620, algo = 13, bits = 256 Active Published ( ECDSAP256SHA256 )
<br>
CSK DNSKEY = <a href="http://anotherlife.net">anotherlife.net</a>. IN DNSKEY 257 3 13 fo66pKO4AgAWhkJ7nAo89ASFTlIedody5Hq/RvG9ntjEIKLRxg/DlTYcD0ZzzR5U5fC0YjQKq2jJK3xtlRp2tA== ; ( ECDSAP256SHA256 )<br>
DS = <a href="http://anotherlife.net">anotherlife.net</a>. IN DS 54620 13 1 34a8867caea8853a71567e03cf639dea0e1b7d49 ; ( SHA1 digest )<br>
DS = <a href="http://anotherlife.net">anotherlife.net</a>. IN DS 54620 13 2 5b7f150a199a6d29c64a0a27822a99bc1caa6d051ac62a42ccb022aad919058b ; ( SHA256 digest )<br>
DS = <a href="http://anotherlife.net">anotherlife.net</a>. IN DS 54620 13 4 03d435af34a1508735234b54a1125aaea7e35d16570e44a2d0ab41255d02d8649d64e750ef6deaac4a698426f8f3ccef ; ( SHA-384 digest )<br>
<br>
However, when I test my zones with 'dig command' I receive a unexpect result: all zones have the same validity period<br>
<br>
dig @xx.xxx.xx.xx <a href="http://strangeworld.net">strangeworld.net</a> +dnssec +short<br>
10.200.12.151<br>
A 13 2 3600 20220407000000 20220317000000 14784 <a href="http://strangeworld.net">
strangeworld.net</a>. PWeyW+0vHEMIbB3syYeLAhpE0gxUY9KE9G8Ux3vtr3vpuiKWsUFfZ6cR cBZ6rXWqZxvgnKjSxvMA05S3ZMMRdA==<br>
<br>
<br>
<br>
dig @xx.xxx.xx.xx <a href="http://anotherlife.net">anotherlife.net</a> +dnssec +short<br>
10.200.12.151<br>
A 13 2 3600 20220407000000 20220317000000 54620 <a href="http://anotherlife.net">
anotherlife.net</a>. ffWofGgMfkqsKzXTwiFnu40wBqn6UJmDrCaqxsEx4RHI7/3wU4xgScSQ 2gJxS49U8xrz2QVjDn4noIzy3lqNPA==<br>
<br>
How could I configure my Primary Servers to sign zones with different validity periods ?<br>
<br>
I tried set on my config file the options:<br>
<br>
default-soa-edit=INCREMENT-WEEKS<br>
default-soa-edit-signed=INCREMENT-WEEKS<br>
<br>
I tried other values too, but nothing seems to work<br>
<br>
Well, how could I solve this issue?<br>
And please sorry my poor knowledge about the powerdns and about english language too rsrs<br>
<br>
Regards<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>