Subject: nsupdate and DNSSEC

From: Michael Richardson <[email-masked]>
Date: Mon, 11 Mar 2002 23:39:22 -0500

-----BEGIN PGP SIGNED MESSAGE-----

  I am attempting to test the secure-ddns-howto instructions before I leave.
I do:

marajade-[/etc/namedb] root 7 #nsupdate -v -k Kmarajade.dasblinkenled.org.+157+32846.key 
> server 192.139.46.30
> zone dasblinkenled.org
> update delete marajade.dasblinkenled.org A
> update add marajade.dasblinkenled.org 3600 A 192.139.46.20 
> send
> EOF

and on the server, in the logs, I see:

Mar 11 22:46:46.721 update: info: client 192.139.46.20#65215: updating zone 'das
blinkenled.org/IN': deleting an rrset
Mar 11 22:46:46.734 update: info: client 192.139.46.20#65215: updating zone 'das
blinkenled.org/IN': adding an RR
Mar 11 22:46:46.746 update: error: could not get zone keys for secure dynamic up
date
Mar 11 22:46:46.747 update: error: client 192.139.46.20#65215: updating zone 'da
sblinkenled.org/IN': SIG/NXT update failed: file not found

  So, I need to let bind know where the private key for the zone is so that
it can sign the new records.

  I have been through the bind 9.2.0 manual with a fine tooth comb. I do not
see any place to inform bind 9.2.0 about the private key file for signing a
zone.

  I then grep'ed the source code for the error message and followed some of
the functions via etags. 
  Not obvious that the K*.key files MUST be in your designed directory. I had
them in a subdirectory. Having figured this out, I now see one sentence in:
Bv9ARM.ch04.html#AEN932 

  >  Note that the DNSSEC tools require the keyset and signedkey files to be in
  >  the working directory, and that the tools shipped with BIND 9.0.x are not
  >  fully compatible with the current ones. 

  It is probably worth emphasizing why this is required. It isn't required
for dnssec-signzone, since you have to tell it the file names anyway.
  
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [