<html dir="ltr"><head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style title="owaParaStyle">P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</style>
<meta content="MSHTML 6.00.6000.16825" name="GENERATOR">
</head>
<body ocsi="x">
<div dir="ltr"><font face="Lucida Console" color="#000000" size="2">I am running bind in a chroot jail, btw.</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">I had this working a while ago, and left it for a while</font></div>
<div dir="ltr"><font face="lucida console" size="2">and then tried to set it up again, with no luck.</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">I am sure it is something simple...</font></div>
<div>
<div><font face="Tahoma" size="2">
<div dir="ltr" align="left"><font face="Lucida Console" size="2">--</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">Jack Tavares</font></div>
<div dir="ltr" align="left"></font> </div>
</div>
<div><font face="Lucida Console"></font> </div>
</div>
<div id="divRpF137036" style="DIRECTION: ltr">
<hr tabindex="-1">
<font face="Tahoma" size="2"><b>From:</b> bind-users-bounces@lists.isc.org [bind-users-bounces@lists.isc.org] On Behalf Of Jack Tavares [j.tavares@F5.com]<br>
<b>Sent:</b> Wednesday, May 13, 2009 10:27<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> error while attempting to use nsupdate on a DNSSEC signed zone<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr"><font face="Lucida Console" color="#000000" size="2">Hello -</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">(bind9.6.0-P1)</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">I have set up a zone that is signed.</font></div>
<div dir="ltr"><font face="lucida console" size="2">It is an island of security zone for testing purposes.</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">I have set up a TSIG key and set the allow-update</font></div>
<div dir="ltr"><font face="lucida console" size="2">to accept the key.</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">I have followed every step, afaict, in the various
</font></div>
<div dir="ltr"><font face="lucida console" size="2">how-tos on how to sign a zone.</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">But when I try to do an update, I get an error.</font></div>
<div dir="ltr"><font face="lucida console" size="2"></font> </div>
<div dir="ltr"><font face="lucida console" size="2">All the error says is</font></div>
<div dir="ltr">signer "update.test.net" approved<br>
13-May-2009 14:16:37.947 client 127.0.0.1#2490: view external: updating zone 'test.net/IN': adding an RR at 'blah.test.net' A<br>
13-May-2009 14:16:37.953 client 127.0.0.1#2490: view external: updating zone 'test.net/IN': RRSIG/NSEC/NSEC3 update failed: failure<br>
</div>
<div dir="ltr"><font face="times new roman">"failure" is all it says for a reason.</font></div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman">I looked at the bind source, and there are some more useful error messages about keys etc.</font></div>
<div dir="ltr"><font face="times new roman">But all I am getting is "failure".</font></div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman">If i do the same nsupdate without DNSSEC, it works.
</font></div>
<div dir="ltr"><font face="times new roman">It appears there is something wrong with my setup and the regeneration of the RRSIG/NSEC</font></div>
<div dir="ltr"><font face="times new roman">keys is failing. (I have tried it with both NSEC and NSEC3 keys)</font></div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman">I will put together a (simpler) named.conf and zone file that causes this and post that info,</font></div>
<div dir="ltr"><font face="times new roman">but I was hoping that maybe somebody has seen this and has an idea.</font></div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div dir="ltr"><font face="times new roman">Thanks</font></div>
<div dir="ltr"> </div>
<div dir="ltr"><font face="times new roman"></font> </div>
<div><font face="Tahoma" size="2">
<div dir="ltr" align="left"><font face="Lucida Console" size="2">--</font></div>
<div dir="ltr" align="left"><font face="Lucida Console" size="2">Jack Tavares</font></div>
</font></div>
<div><font face="Lucida Console"></font> </div>
</div>
</body>
</html>