randy/scratch.md

OpenDNSSec to Knot Inline Signing

Get Keys from Bind9

On the bind9 / OpenDNSsec system

cd /usr/home/dns/dkeys
sh ~sra/extractor/key-extracter.sh
#!/bin/sh

ZONE=$1
FNAME=$2

ZSK=`grep -l "256 " K$ZONE+*.key`
KSK=`grep -l "257 " K$ZONE+*.key`

echo KSK=$KSK
echo ZSK=$ZSK

dnssec-settime \
    -f \
    -P 20040301 \
    -A 20040301 \
    $KSK

dnssec-settime \
    -f \
    -P 20240301 \
    -A 20240301 \
    -I 20240610 \
    -D 20240610 \
    $ZSK

And copy over to Knot test host, rip1.rg.net

rsy K*ymbk.com.* root@rip1.rg.net:/var/lib/knot/import

And import them

rip1.rg.net:/var/lib/knot/import# chown -R knot:knot .
rip1.rg.net:/var/lib/knot/import# keymgr ymbk.com import-bind Kymbk.com.+008+30069
ddc26a0d339674bfa9a4fcaa36240a0c7975a42d
OK
rip1.rg.net:/var/lib/knot/import# keymgr ymbk.com import-bind Kymbk.com.+008+30334
53d0486e9ffc064ea6f46ca25526501ffe1a549c
OK
rip1.rg.net:/var/lib/knot/import# keymgr ymbk.com import-bind Kymbk.com.+008+53482
1ebc1be31ef866e401ffa4de0d825003527b99bc
OK