Re: DNSSEC: Configuring auto-signed dynamic zone HOWTO

2010-02-23 Thread Kevin Oberman
> Date: Tue, 23 Feb 2010 16:02:27 -0500 > From: Alan Clegg > Sender: bind-users-bounces+oberman=es@lists.isc.org > > Nicholas Wheeler wrote: > > On Tue, 2010-02-23 at 23:40 +0300, Eugene Crosser wrote: > >> (Well, for now the plan is to do it once a year by hand. Then, we'll > >> see...) >

Re: DNSSEC: Configuring auto-signed dynamic zone HOWTO

2010-02-23 Thread Paul Wouters
On Tue, 23 Feb 2010, Alan Clegg wrote: For the record, NIST recommends to roll the ZSK every three months, and the KSK every two years. And there are lots of other opinions on this timing as well. Note that you cannot really talk about rolling key recommendations without mentioning the key s

Re: DNSSEC: Configuring auto-signed dynamic zone HOWTO

2010-02-23 Thread Alan Clegg
Nicholas Wheeler wrote: > On Tue, 2010-02-23 at 23:40 +0300, Eugene Crosser wrote: >> (Well, for now the plan is to do it once a year by hand. Then, we'll see...) > > For the record, NIST recommends to roll the ZSK every three months, and > the KSK every two years. And there are lots of other op

Re: DNSSEC: Configuring auto-signed dynamic zone HOWTO

2010-02-23 Thread Nicholas Wheeler
On Tue, 2010-02-23 at 23:40 +0300, Eugene Crosser wrote: > (Well, for now the plan is to do it once a year by hand. Then, we'll see...) For the record, NIST recommends to roll the ZSK every three months, and the KSK every two years. Thanks, -- Nicholas signature.asc Description: This is a

Re: DNSSEC: Configuring auto-signed dynamic zone HOWTO

2010-02-23 Thread Eugene Crosser
Stephane Bortzmeyer wrote: > There is nothing about key rollover, it seems? How do you handle it? I don't. (Well, for now the plan is to do it once a year by hand. Then, we'll see...) Regards, Eugene signature.asc Description: OpenPGP digital signature __

Re: DNSSEC: Configuring auto-signed dynamic zone HOWTO

2010-02-23 Thread Stephane Bortzmeyer
On Mon, Feb 22, 2010 at 11:40:49AM +0300, Eugene Crosser wrote a message of 49 lines which said: > Reviewed version placed here: http://www.average.org/dnssec/ There is nothing about key rollover, it seems? How do you handle it? ___ bind-users mail

Re: DNSSEC: Configuring auto-signed dynamic zone HOWTO

2010-02-22 Thread Eugene Crosser
> HOW TO CONFIGURE AUTO-SIGNED DYNAMIC ZONES WITH BIND9 > > This document describes how to configure bind9 to > automatically sign zones as they are being modified > by dynamic update mechanism. Reviewed version placed here: http://www.average.org/dnssec/ Eugene

DNSSEC: Configuring auto-signed dynamic zone HOWTO

2010-02-18 Thread Eugene Crosser
Please comment! Eugene === HOW TO CONFIGURE AUTO-SIGNED DYNAMIC ZONES WITH BIND9 This document describes how to configure bind9 to automatically sign zones as they are being modified by dynamic update mechanism. It is assumed that you already know how