Cascade zone resigning failed on Debian 12

Cascade
1

Morning,

I have a Cascade setup along side NSD on a vm for testing. Cascade(127.0.0.1) listens on the localhost and AXFR to the NSD which listens on 192.168.8.153.
As I am just testing, I setup a short lived signature policy so that I can see results fast. All went well initially; zones where added, signed by Cascade and XFR to NSD.
After few hours, dig output shows: “EDE: 24 (Invalid Data): (Zone has expired)” Then I ran cascade zone reload test.lab but the SERVFAIL persist. It was an hour later the zone was available.

I am testing a Debian 12 and AppArmor tweaked so NSD can strictly writes to /var/lib/nsd.

Here is my /etc/cascade/config:

version = “v1”

policy-dir = “/etc/cascade/policies”
zone-state-dir = “/var/lib/cascade/zone-state”
tsig-store-path = “/var/lib/cascade/tsig-keys.db”
kmip-credentials-store-path = “/var/lib/cascade/kmip/credentials.db”
keys-dir = “/var/lib/cascade/keys”
kmip-server-state-dir = “/var/lib/cascade/kmip”
dnst-binary-path = “dnst”

[daemon]
log-level = “info”
log-target = { type = “syslog” }
daemonize = false

[remote-control]
servers = [“127.0.0.1:4539”]

[loader]
review.servers = [“127.0.0.1:4540”]

[signer]
review.servers = [“127.0.0.1:4541”]

[server]
servers = [“192.168.8.153:4542”]

My /etc/cascade/policies/default.toml:

version = “v1”

[signer]
serial-policy = “date-counter”
signature-inception-offset = “5m”
signature-lifetime = “2h”
signature-remain-time = “30m”
signature-refresh-interval = “15m”
key-roll-time = “1h”

[signer.denial]
type = “nsec”

[server.outbound]

send-notify-to = [“127.0.0.1^lab-transfer-key.”, “192.168.8.153^lab-transfer-key.”]
provide-xfr-to = [“127.0.0.1^lab-transfer-key.”, “192.168.8.153^lab-transfer-key.”]

And NSD /etc/nsd/nsd.conf:

server:
ip-address: 192.168.8.153
port: 53
username: nsd
zonesdir: “/var/lib/nsd”
logfile: “/var/log/nsd.log”
hide-version: yes

key:
name: “lab-transfer-key.”
algorithm: hmac-sha256
secret: “REDACTED”

remote-control:
control-enable: no

zone:
name: “test.lab”
zonefile: “test.lab.signed”
allow-notify: 192.168.8.153 lab-transfer-key.
request-xfr: 192.168.8.153@4542 lab-transfer-key.

zone:
name: “demo.lab”
zonefile: “demo.lab.signed”
allow-notify: 192.168.8.153 lab-transfer-key.
request-xfr: 192.168.8.153@4542 lab-transfer-key.

zone:
name: “example.lab”
zonefile: “example.lab”

I am curious why the automatic resigning failed and why cascade reload did not resolve it immediately, any insights or troubleshooting steps would appreciated. Thanks :slight_smile:

2

I don’t think you’ve mentioned which version of Cascade you are using nor how the zone was initially loaded into it.

3

Thanks @jpmens , Cascade version is 0.1.0-beta5. After creating the zone at /etc/cascade/zones, I ran these:

sudo cascade policy reload

sudo cascade zone add --source /etc/cascade/zones/test.lab.zone --policy default test.lab.

sudo cascade zone reload test.lab.

sudo systemctl restart nsd
4

I seem to recall at least one reload bug, but can’t find an open issue on this.

I would suggest submitting a bug report.

5

There could be a reload bug. It would be nice to check the ‘cascade zone status’ and ‘cascade zone history’ commands to see if cascade did something.

6

Thank you both, I have somehow get the zone auto resigning. I change this in my policy file:

signature-remain-time = “45m”

The value was originally was 30m, changed it to 45m. Here is the whole [signer] table:

[signer]
serial-policy = “date-counter”
signature-inception-offset = “5m”
signature-lifetime = “2h”
signature-remain-time = “45m”
signature-refresh-interval = “15m”
key-roll-time = “1h”

I read this in the docs on page 76:

signature-refresh-interval should be a lot smaller than signature-remain-time to make sure that signatures are refreshed in time. If this is not the case then in extreme cases, signatures could expire.

So my signature-remain-timebeing twice (30m) the value of the signature-refresh-interval(15m), I felt it (signature-remain-time)needs to go up.