<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">Hello.</p>
<p dir="auto">Using BIND 9.16.1-Ubuntu (Stable Release) <a href="id:d497c32" style="color:#3983C4">id:d497c32</a> because that’s<br>
what’s most simply available on Ubuntu 20.04.3 LTS (Focal Fossa),<br>
I’m seeing messages reporting that private key files can’t be found,<br>
such as the one in the subject line. The files look to me to be<br>
present as expected.</p>
<p dir="auto">I shall be grateful for any helpful advice.</p>
<p dir="auto">The relevant part of my configuration is further down.</p>
<p dir="auto">This appeared to work as expected on a development server running<br>
9.18 from the ISC PPA. For production purposes, we would prefer<br>
to rely, if possible, on what is available without adding a PPA.</p>
<p dir="auto">Best regards,<br>
Niall O’Reilly</p>
<pre style="background-color:#F7F7F7; border-radius:5px 5px 5px 5px; margin-left:15px; margin-right:15px; max-width:90vw; overflow-x:auto; padding:5px" bgcolor="#F7F7F7"><code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0" bgcolor="#F7F7F7">dnssec-policy onboarding {
// This policy attempts to match or accommodate what zonefactory did
// YMMV!
dnskey-ttl 3600;
keys {
ksk lifetime 3650d algorithm rsasha256;
zsk lifetime 3650d algorithm rsasha256;
};
max-zone-ttl 3600;
parent-ds-ttl 86400;
parent-propagation-delay 48h;
publish-safety 7d;
retire-safety 7d;
signatures-refresh 5d;
signatures-validity 30d;
signatures-validity-dnskey 30d;
zone-propagation-delay 2h;
};
zone "foo.ie" {
type primary;
update-policy local;
file "/etc/bind/dynamic/foo.ie/db.foo.ie";
key-directory "/etc/bind/dynamic/foo.ie/";
masterfile-format text;
dnssec-policy onboarding; # Policy under test
// dnssec-policy default; # triggers retirement of existing keys
// auto-dnssec maintain; # continues use of existing keys
notify explicit; # Testing: don't propagate confusion! ;-)
also-notify {
downstream-in-house;
};
allow-transfer {
key in-house.ns.my-own.net.;
};
};
</code></pre>
</div></div>
</body>
</html>