From: Jonathan Larmour <jiflsw@jifvik.org>
To: Sourceware Overseers <overseers@sourceware.org>
Subject: Re: dnssec for sourceware
Date: Fri, 03 Oct 2014 15:06:00 -0000 [thread overview]
Message-ID: <542EBB82.3080102@jifvik.org> (raw)
In-Reply-To: <CAKOQZ8ybhcuPfBmFOXLir7Xf5_9d7FpL=U68knN4qUv48XwO8A@mail.gmail.com>
On 12/07/14 16:20, Ian Lance Taylor wrote:
> On Sat, Jul 12, 2014 at 4:01 AM, Frank Ch. Eigler <fche@redhat.com> wrote:
>>
>> I believe sourceware.org is set up (with a third-party bind 9.9)
>> with dnssec data locally. The registrar needs to add just these
>> two records to their zone:
>>
>> sourceware.org. IN DS 1828 5 2 AC36913913EC104BB10588DF9AE6BE89281431300F28F6CC70A886FD2904B55C
>> sourceware.org. IN DS 96 5 2 29219704D9D4FA42DB897CD82ACE824E73EDB3AD5B7FBDBCF07DA49B26C69C32
>
> Thanks. I've installed those keys in the DNS registrar for
> sourceware.org. I also made sure that the secondary name servers are
> updated.
[snip]
I've had a report from a user that something isn't right here for
ecos.sourceware.org and bugs.ecos.sourceware.org, with their BIND
complaining about the lack of RRSIGs:
> Oct 2 20:30:45 lapis named[689]: error (no valid RRSIG) resolving 'ecos.sourceware.org/DS/IN': 202.37.101.2#53
> Oct 2 20:30:45 lapis named[689]: error (no valid RRSIG) resolving 'ecos.sourceware.org/DS/IN': 202.37.101.1#53
> Oct 2 20:30:46 lapis named[689]: error (chase DS servers) resolving 'ecos.sourceware.org/DS/IN': 209.132.180.131#53
> Oct 2 20:30:47 lapis named[689]: error (no valid RRSIG) resolving 'ecos.sourceware.org/DS/IN': 71.133.8.30#53
> Oct 2 20:30:47 lapis named[689]: error (no valid RRSIG) resolving 'ecos.sourceware.org/DS/IN': 64.13.131.148#53
> Oct 2 20:30:47 lapis named[689]: error (no valid DS) resolving 'bugs.ecos.sourceware.org/A/IN': 202.37.101.1#53
> Oct 2 20:30:47 lapis named[689]: error (no valid DS) resolving 'bugs.ecos.sourceware.org/AAAA/IN': 202.37.101.1#53
They had to put in a workaround in their /etc/hosts file to get it to
work. ecos.sourceware.org is just a CNAME for sourceware.org.
bugs.ecos.sourceware.org is a CNAME for bugzilla.ecoscentric.com which
doesn't have any DNSSEC.
I assume it's just a case of someone adding RRSIGs for these two CNAMEs in
sourceware.org? FAOD, according to
http://tools.ietf.org/html/rfc2181#section-10 it's valid to have RRSIGs
alongside CNAMEs.
Jifl
prev parent reply other threads:[~2014-10-03 15:06 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-07-12 11:02 Frank Ch. Eigler
2014-07-12 15:20 ` Ian Lance Taylor
2014-10-03 15:06 ` Jonathan Larmour [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=542EBB82.3080102@jifvik.org \
--to=jiflsw@jifvik.org \
--cc=overseers@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).