3

I have a working DNSSEC name server. It runs on the BIND 9.18 on recent Fedora. I have two keys (KSK, ZSK), my parent (DNS-wise) got a valid DS record and everything is fine. Really. The DNSSEC analyzers are happy with the setup too.

But then came this log message:

'auto-dnssec' option is deprecated and will be removed in BIND 9.19. Please migrate to dnssec-policy

I don't know if and when the 9.19 will pushed to updates. But I tried to be prepared and replaced this config (in the zone block):

auto-dnssec maintain;
inline-signing yes;

with:

dnssec-policy sk_policy;
inline-signing yes;

and the policy itself is defined in the top level config:

dnssec-policy "sk_policy" {
    keys {
        ksk key-directory lifetime unlimited algorithm ecdsa256;
        zsk key-directory lifetime unlimited algorithm ecdsa256;
        // zsk rollover postponed for later
        // zsk key-directory lifetime P90D algorithm ecdsa256;
    };  
    nsec3param iterations 0 optout no salt-length 0;
    parent-ds-ttl PT1H;
};

but the server logs every 10 minutes an error:

reconfiguring zone keys
zone_rekey:dns_dnssec_keymgr failed: error occurred writing key to disk

Google did not find anything when I searched for this error message.

I tried with file permissions allowing everything in the keys directory, I tried to temporarily disable the SELinux (strict -> permissive to be precise), but no warnings were generated. Nothing helped so far. I don't know what file the server wants to write, where, what error. I also tried to remove the journal files, etc. but this is a production machine, I cannot experiment too much, so I returned everything to the original state and will stick with the version 9.18 for now.

Could anybody help to get the 'dnssec-policy' working without errors?


UPDATE #2: - I posted a summary of my experiments as an (preliminary) answer. I'm still looking for a good source of information in order to stop this trial-error experiments.

2 Answers 2

1

I had the same problem:

zone_rekey:dns_dnssec_keymgr failed: error occurred writing key to disk

It seems to be only a permission problem.

I changed the permission of my /etc/bind/keys directory to rwxrwxr-- (774) and all the files therein to rw-rw-r-- (664).

  • keys directory owner is root
  • keys directory group is bind

After that it works.  I got the following messages and the owner of some files changed:

2023-02-05T17:27:16+0100 fake_servername named[1234441]        ..... (some more related messages before here)
2023-02-05T17:27:16+0100 fake_servername named[1234441]: general: warning: Permissions on the file /etc/bind/keys/fake_domainname.de.+015+60580.private have changed from 0664 to 0600 as a result of this operation.
4
  • Thank you. In my case it is probably a permission problem and SELinux problem in the same time. I haven't got time to verify it yet. I'd like to ask: 1) Are you using SELinux? 2) After the message about file mode changed "from 0664 to 0600 ", did the mode really changed? In my case it did not (file owner is root, named/bind user cannot chmod)
    – VPfB
    Feb 6, 2023 at 6:41
  • yes some changed its on debian: Description: Debian GNU/Linux 11 (bullseye) Linux 5.10.0-20-amd64 #1 SMP Debian 5.10.158-2 (2022-12-13) x86_64 GNU/Linux with apparmor. ls -rw-r--r-- 1 bind bind 429 Feb 6 18:32 Kbeispiel.de.+013+18462.key -rw------- 1 bind bind 215 Feb 6 18:32 Kbeispiel.de.+013+18462.private -rw-r--r-- 1 bind bind 666 Feb 6 18:32 Kbeispiel.de.+013+18462.state -rw-rw-r-- 1 root bind 428 Feb 6 18:37 Kbeispiel.de.+015+25807.key -rw-rw-r-- 1 root bind 227 Feb 6 18:37 Kbeispiel.de.+015+25807.private Feb 6, 2023 at 20:03
  • sorry did not get it right with the formating Feb 6, 2023 at 20:05
  • Never mind the formatting. Thank you for sharing your working config.
    – VPfB
    Feb 7, 2023 at 20:15
0

I think I got it working (maybe except a key rollover which I did not test yet). I decided to write a summary:

A DNSSEC key (in BIND) consists of 3 files: the public part, the secret counterpart and a key status file. The name extensions are: .key, .private, .state respectively.

With auto-dnssec maintain, the DNSSEC key files can be read-only. But when migrating to dnssec-policy, the BIND server will modify the key files and it will modify all three files, not only the status. (I don't understand why. I thought the existence of a status file makes editing of "true" key files unnecessary.)

The obvious requirement is to adjust the key files' permissions:

I used root:named as owner:group and mode 0770 for the directory, 0660 for the files. Obviously this is not the only possible setting. Important is that the server must be able to modify the files. The private keys should stay protected. See also the answer by "le luxe fou". Note that on his system the user named is called bind.

What I had problems at the beginning was the SELinux. Note that this section might be Fedora specific and the SELinux policy may change in future. I got no AVC denial messages at the beginning (maybe I made a mistake somewhere), that's why I posted this question.

In short, I had keys in the /etc/named/keys directory. SELinux considers files in that location a write-protected configuration. So I put them to /var/named/keys, i.e. to a location where the server can modify files. Don't know if that is the proper place for keys. but I really didn't want to add a local policy with audit2allow unless really necessary.

Final note: the server logs:

Permissions on the file /var/named/keys/KXXX.+YYY+ZZZZ.private have changed from 0660 to 0600 as a result of this operation

but it is not true, the permissions are unchanged. Probably the named (bind) user is the intended owner of key files. I did not find any docs in that regard.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .