DNSSEC transition from manually signed zone to dnssec-policy "standard" failed

Wed Jun 1 21:14:59 UTC 2022

Dear All,

I have tried to switch from manually signed DNSSEC zone to dnssec-policy 
"standard", and BIND9 server started
behaving odd. Here is the manual signing conf:

include "/etc/bind/keys/domac.alu.hr-tsig.key";

zone "alu.hr" in {
         type master;
         file "/etc/bind/zones/alu.hr.db.signed";
         allow-transfer { key domac.alu.hr-key; 161.53.2.70; };
         also-notify { 31.147.205.54; 161.53.2.70; };
         forwarders {};
};

... and the automatic signing conf:

zone "alu.hr" in {
         type master;
         file "/var/cache/bind/alu.hr.db";
         allow-transfer { key domac.alu.hr-key; 161.53.2.70; };
         also-notify { 31.147.205.54; 161.53.2.70; };
         dnssec-policy "standard";
         forwarders {};
};

There was a symbolic link /var/cache/bind/alu.hr.db -> 
/etc/bind/zones/alu.hr.db .

The logfile is too long to post, so I will add link: 
https://domac.alu.hr/~mtodorov/tmp/named-20220601.log

NOTE: Fun starts when I tried to automatically sing zone in zonefile 
/etc/bind/zones/alu.hr.db, and APPARMOR denied opening file to BIND. 
Maybe that confused the good old BIND9 server?

Then I added link in /var/cache/bind, as for DDNS zones.

The the zone appeared signed, but with only NSEC records, no RRSIGs, 
with this in log:

Jun  1 21:52:42 domac named[46537]: scheduled loading new zones
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (unsigned): loaded 
serial 2022060101
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): loaded 
serial 2022060101
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): 
receive_secure_serial: unchanged
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): sending 
notifies (serial 2022060101)
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): 
reconfiguring zone keys
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): 
zone_rekey:dns_zone_getdnsseckeys failed: not found
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: keymgr: retire DNSKEY 
alu.hr/RSASHA256/46119 (ZSK)
Jun  1 21:52:42 domac named[46537]: keymgr: retire DNSKEY 
alu.hr/RSASHA256/34042 (KSK)
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: Fetching alu.hr/ECDSAP256SHA256/3502 
(ZSK) from key repository.
Jun  1 21:52:42 domac named[46537]: DNSKEY alu.hr/ECDSAP256SHA256/3502 
(ZSK) is now published
Jun  1 21:52:42 domac named[46537]: DNSKEY alu.hr/ECDSAP256SHA256/3502 
(ZSK) is now active
Jun  1 21:52:42 domac named[46537]: Fetching 
alu.hr/ECDSAP256SHA256/43987 (KSK) from key repository.
Jun  1 21:52:42 domac named[46537]: DNSKEY alu.hr/ECDSAP256SHA256/43987 
(KSK) is now published
Jun  1 21:52:42 domac named[46537]: DNSKEY alu.hr/ECDSAP256SHA256/43987 
(KSK) is now active
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): next key 
event: 01-Jun-2022 23:46:06.043
Jun  1 21:52:42 domac named[46537]: any newly configured zones are now 
loaded
Jun  1 21:52:42 domac named[46537]: running
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort
Jun  1 21:52:42 domac named[46537]: zone alu.hr/IN (signed): attempt to 
lock key files, but no key file lock available, abort

I couldn't Google out any such message.

However, the BIND server started acting like a runaway, displying lines 
like this in the log:

Jun  1 22:06:55 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:55 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating hr/DS: no valid signature 
found
Jun  1 22:06:56 domac named[43715]: validating hr/DS: no valid signature 
found
Jun  1 22:06:56 domac named[43715]: validating hr/DS: no valid signature 
found
Jun  1 22:06:56 domac named[43715]: validating arpa/DS: no valid 
signature found
Jun  1 22:06:56 domac named[43715]: validating ./NS: no valid signature 
found

... and at very fast rate, so I reverted to the manually signed conf.

Any idea how could I still apply dnssec-policy? Manual signing works, 
but it is tedious, and easy to forget to sign ...

For other subzones, mainly slava.alu.hr, conversion from manually signed 
RSA keys to automatically signed DNSSEC standard policy worked 
out-of-the-box.

HERE is the policy (from DNSSEC manual):

dnssec-policy standard {
     dnskey-ttl 600;
     keys {
         ksk lifetime 365d algorithm ecdsap256sha256;
         zsk lifetime 60d algorithm ecdsap256sha256;
     };
     max-zone-ttl 600;
     parent-ds-ttl 600;
     parent-propagation-delay 2h;
     publish-safety 7d;
     retire-safety 7d;
     signatures-refresh 5d;
     signatures-validity 15d;
     signatures-validity-dnskey 15d;
     zone-propagation-delay 2h;
};

Thanks for any idea how to get out of this.

Hope this helps.

Kind regards,
Mirsad

-- 
Mirsad Todorovac
CARNet system engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb, Republic of Croatia
tel. +385 (0)1 3711 451
mob. +385 91 57 88 355