<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.E-MailFormatvorlage20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE-AT" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">IIRC, Bind needs the key as long as there are signatures in the zone generated by this key. After key deactivation I waited the RRSIG
lifetime before deleting them.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Klaus<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Von:</span></b><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> bind-users <bind-users-bounces@lists.isc.org>
<b>Im Auftrag von </b>egoitz--- via bind-users<br>
<b>Gesendet:</b> Montag, 24. Jänner 2022 13:00<br>
<b>An:</b> bind-users@lists.isc.org<br>
<b>Betreff:</b> Bind 9, dnssec, and .key .private files physical deletion after the key id becomes deleted from zone (the key becomes outdated)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">Good morning,<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">I have a DNSSEC "bump in wire" server, which uses "inline-signing yes;" and "auto-dnssec maintain;" for that reason.<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">I do the task of ensuring always are valid keys in the zone with an script that generates them whenever is needed. All fine until here and all working.<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">I have seen, that Bind logs in messages log file sometimes the following error logs :<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
<p><em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:blue;background:#FFFF99">dns_dnssec_keylistfromrdataset: error reading /xxx/xxx/xxx/xx-domain/named.aaa/aaa.xx.+008+41919.private: file not found</span></em><span style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">That "file not found" is due to a rename of ".key" and ".private" files to ".key-OLD" and ".private-OLD".<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">I did the rename, because I have seen that the ZSK key 41919 was set to be deleted (and obviously always renamed after that deletion date) from the zone, so I renamed the ".key" and ".private"
files to ".key-OLD" and ".private-OLD".<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">I do this rename, because this way my key checking script differentiates, any needed (in effect) key with the "supposedly" (I say supposedly because I would have said that Bind should not be
using nowadays that non finding files for nothing!) non needed keys, in order to check that each zone, has always the needed keys for keeping properly signed by Bind (else it would generate them).<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">As I previously commented, I check with a script the existence of all needed keys for each domain. Obviuosly, it's not the same checking a couple of ZSK or just one ZSK and a KSK (per domain),
than them plus all outdated keys that each month become outdated.<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">So, how many time should I wait in order to rename that files?. Should I handle them with another dnssec-______ command instead of renaming?. All seems to be working well but I see these errors
and was wondering if I could improve the way of handling outdated keys.<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">I have been taking a look at the source code of Bind (the tag of version I'm using), and I have seen that Bind seems not remove any of that key files when they become outdated. Or does it with
some param?. I have not been able to find it. I have been taking a look too the ARM, but still no luck on finding the answers I was trying to.<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">Any help very appreciated,<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Verdana",sans-serif">Best regards,<o:p></o:p></span></p>
</div>
</div>
</body>
</html>