OpenDNSSEC http://www.opendnssec.org OpenDNSSEC News Thu, 16 May 2013 13:08:11 +0000 en hourly 1 http://wordpress.org/?v=3.1.2 OpenDNSSEC 1.3.14 http://www.opendnssec.org/2013/05/16/opendnssec-1-3-14/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-3-14 http://www.opendnssec.org/2013/05/16/opendnssec-1-3-14/#comments Thu, 16 May 2013 13:08:11 +0000 sara http://www.opendnssec.org/?p=1094 Version 1.3.14 of OpenDNSSEC has now been released:

Updates:

  • OPENDNSSEC-367: ods-ksmutil: Require user confirmation if the algorithm for  a key is changed in a policy (as this rollover is not handled cleanly)
  • OPENDNSSEC-91: Make the keytype flag required when rolling keys
  • OPENDNSSEC-403: Signer Engine: new command ‘ods-signer locks’ that shows  locking information (for debugging purposes).

Bugfixes:

  • OPENDNSSEC-247: Signer Engine: TTL on NSEC3 was not updated on SOA  Minimum change.
  • OPENDNSSEC-396: Use TTLs from kasp when generating DNSKEY and DS records for  output.
  • OPENDNSSEC-398: The ods-ksmutil key rollover command does not work correctly  when rolling all keys using the –policy option
  • SUPPORT-40: Signer Engine: Keep occluded data in signed zone files/transfers.

Documentation:

Download:

 

]]> http://www.opendnssec.org/2013/05/16/opendnssec-1-3-14/feed/ 0 OpenDNSSEC 1.4.0 http://www.opendnssec.org/2013/04/22/opendnssec-1-4-0/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-4-0 http://www.opendnssec.org/2013/04/22/opendnssec-1-4-0/#comments Mon, 22 Apr 2013 10:31:35 +0000 sara http://www.opendnssec.org/?p=1077 Version 1.4.0 of OpenDNSSEC has now been released.  This is the latest stable release.

Updates since 1.4.0rc3:

Documentation:

Download:

]]> http://www.opendnssec.org/2013/04/22/opendnssec-1-4-0/feed/ 0 OpenDNSSEC 1.4.0rc3 http://www.opendnssec.org/2013/03/15/opendnssec-1-4-0rc3/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-4-0rc3 http://www.opendnssec.org/2013/03/15/opendnssec-1-4-0rc3/#comments Fri, 15 Mar 2013 14:17:28 +0000 sara http://www.opendnssec.org/?p=1071 Version 1.4.0rc3 of OpenDNSSEC has now been released. This version is recommended for testing only, not for use in production environments.

Updates:

  • Further testing of OPENDNSSEC-387 completed, release returned to rc status.

Documentation:

Download:

 

]]> http://www.opendnssec.org/2013/03/15/opendnssec-1-4-0rc3/feed/ 0 OpenDNSSEC 1.4.0b3 http://www.opendnssec.org/2013/02/21/opendnssec-1-4-0b3/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-4-0b3 http://www.opendnssec.org/2013/02/21/opendnssec-1-4-0b3/#comments Thu, 21 Feb 2013 17:19:42 +0000 sara http://www.opendnssec.org/?p=1064 Version 1.4.0b3 of OpenDNSSEC has now been released. This version is recommended for testing only, not for use in production environments.

*NOTE: This release is marked as a beta release (rather than rc3) due to OPENDNSSEC-387, which is a significant functional change compared to rc2.

Updates:

  • OPENDNSSEC-387: Rollback of multi-threaded enforcer. Due to key allocation issues the usefulness of the threaded enforcer is outweighed by the code complications. The option still remains in conf.xml for compatibility with existing use; but it will now be silently ignored.

Bugfixes:

  • OPENDNSSEC-388: Signer Engine: Internal serial should take into account the inbound serial.
  • SUPPORT-50/51: Signer Engine: Inbound DNS Adapter incorrectly updates NSEC3PARAM and DNSKEY RRset [OPENDNSSEC-389]
  • OPENDNSSEC-389: Input DNS Adapter incorrectly updating NSEC3PARAM and DNSKEY RRsets

Documentation:

Download:

**NOTE: This release is signed with the new OpenDNSSEC Distribution key (2013) available from: https://wiki.opendnssec.org/display/OpenDNSSEC/PGP

 

]]> http://www.opendnssec.org/2013/02/21/opendnssec-1-4-0b3/feed/ 0 OpenDNSSEC 1.3.13 http://www.opendnssec.org/2013/02/20/opendnssec-1-3-13/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-3-13 http://www.opendnssec.org/2013/02/20/opendnssec-1-3-13/#comments Wed, 20 Feb 2013 20:08:54 +0000 sara http://www.opendnssec.org/?p=1055 Version 1.3.13 of OpenDNSSEC has now been released:

Bugfixes:

  • OPENDNSSEC-388: Signer Engine: Internal serial should take into account  the inbound serial.
  • OPENDNSSEC-242: Signer Engine: Could get stuck on load signconf while  signconf was not changed.
  • Signer Engine: Fixed locking and notification on the drudge work queue,  signals could be missed so that drudgers would stall when there was work to  be done.

Download:

**NOTE: This release is signed with the new OpenDNSSEC Distribution key (2013) available from: https://wiki.opendnssec.org/display/OpenDNSSEC/PGP

 

]]> http://www.opendnssec.org/2013/02/20/opendnssec-1-3-13/feed/ 0 OpenDNSSEC 1.4.0rc2 http://www.opendnssec.org/2013/01/25/opendnssec-1-4-0rc2/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-4-0rc2 http://www.opendnssec.org/2013/01/25/opendnssec-1-4-0rc2/#comments Fri, 25 Jan 2013 13:16:26 +0000 sara http://www.opendnssec.org/?p=1049 Version 1.4.0rc2 of OpenDNSSEC has now been released. This version is recommended for testing only, not for use in production environments.

Updates:

  • OPENDNSSEC-350: Signer Engine: Better log message when IXFR is not ready for reading.
  • OPENDNSSEC-367: ods-ksmutil: Require user confirmation if the algorithm for a key is changed in a policy (as this rollover is not handled cleanly)

Bugfixes:

  • SUPPORT-44: Signer Engine: Drop privileges after binding to socket [OPENDNSSEC-364].
  • Signer Engine: XFR not ready should not be a fatal status for task read (thanks Ville Mattila).
  • OPENDNSSEC-365: Enforcer: Nasty bug where KSKs could get prematurely retired.

Documentation:

Download:

 

 

]]> http://www.opendnssec.org/2013/01/25/opendnssec-1-4-0rc2/feed/ 0 OpenDNSSEC 1.4.0rc1 http://www.opendnssec.org/2013/01/10/opendnssec-1-4-0rc1/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-4-0rc1 http://www.opendnssec.org/2013/01/10/opendnssec-1-4-0rc1/#comments Thu, 10 Jan 2013 15:22:56 +0000 sara http://www.opendnssec.org/?p=1038 Version 1.4.0rc1 of OpenDNSSEC has now been released. This version is recommended for testing only, not for use in production environments.

Updates:

  • OPENDNSSEC-359: Remove eppclient

Documentation:

Download the tarball from: opendnssec-1.4.0rc1.tar.gz

 

 

]]> http://www.opendnssec.org/2013/01/10/opendnssec-1-4-0rc1/feed/ 0 OpenDNSSEC 1.4.0b2 http://www.opendnssec.org/2012/12/18/opendnssec-1-4-0b2/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-4-0b2 http://www.opendnssec.org/2012/12/18/opendnssec-1-4-0b2/#comments Tue, 18 Dec 2012 10:03:54 +0000 sara http://www.opendnssec.org/?p=1028 Version 1.4.0b2 of OpenDNSSEC has now been released. This version is recommended for testing only, not for use in production environments.

Updates:

  • ods-ksmutil: Deprecate the one-step ‘key backup’ command
  • OPENDNSSEC-292: Provide scripts to convert database between different supported formats
  • OPENDNSSEC-299: ods-ksmutil: ods-ksmutil <enter> now includes policy import
  • OPENDNSSEC-300: ods-ksmutil: policy purge documented with a warning
  • OPENDNSSEC-315: “ods-hsmutil logout” will delete any credentials in the  shared memory.
  • OPENDNSSEC-330: Signer Engine: NSEC3PARAM TTL should be set to zero.
  • OPENDNSSEC-338: ods-ksmutil: fix zone delete on MySQL (broken by SUPPORT-27)
  • OPENDNSSEC-345: ods-ksmutil: use ods-control to HUP the enforcerd process

Bugfixes:

  • SUPPORT-40: Signer Engine: Keep occluded data in signed zone files/transfers.
  • OPENDNSSEC-349: Enforcer: Fix some memory leaks in the enforcer found by valgrind.
  • OPENDNSSEC-353: Signer Engine: Add/remove NSEC3s for empty non-terminals between apex and  delegation when DS is added/removed.
  • Signer Engine: Fixed locking and notification on the drudge work queue, signals could be missed  so that drudgers would stall when there was work to be done.
  • libhsm: Fixed PIN handling on OpenBSD.
  • Enforcer: If enabled enforcer workers and configured number of workers is 1,  make sure that enforcer runs the signer update command after signer  configuration change.
  • Signer Engine: Don’t add double RRSIGs generated by the same key for the  DNSKEY RRset.
  • Signer Engine: Rollback incompleted zone transfers on disk (could happen  if a connection was reset during transfer).
  • Multi-threaded enforcer: various minor fixes including deadlock problems.

Documentation:

Download the tarball from: opendnssec-1.4.0b2.tar.gz

 

]]> http://www.opendnssec.org/2012/12/18/opendnssec-1-4-0b2/feed/ 0 OpenDNSSEC 1.3.12 http://www.opendnssec.org/2012/12/03/opendnssec-1-3-12/?utm_source=rss&utm_medium=rss&utm_campaign=opendnssec-1-3-12 http://www.opendnssec.org/2012/12/03/opendnssec-1-3-12/#comments Mon, 03 Dec 2012 15:34:41 +0000 sara http://www.opendnssec.org/?p=1024 Version 1.3.12 of OpenDNSSEC has now been released:

Bugfixes:

  • SUPPORT-42: ./configure fails on FreeBSD (or if ldns is not installed in a directory in the default search path of the complier).
  • OpenDNSSEC does not compile against ldns 1.6.16 on platforms that rely on the OpenDNSSEC implementation of strlcpy/cat

Download the tarball from: opendnssec-1.3.12.tar.gz

(Please note that the distribution site has now moved to http://dist.opendnssec.org/source/)

]]> http://www.opendnssec.org/2012/12/03/opendnssec-1-3-12/feed/ 0 SoftHSM 1.3.4 http://www.opendnssec.org/2012/11/26/softhsm-1-3-4/?utm_source=rss&utm_medium=rss&utm_campaign=softhsm-1-3-4 http://www.opendnssec.org/2012/11/26/softhsm-1-3-4/#comments Mon, 26 Nov 2012 10:14:25 +0000 sara http://www.opendnssec.org/?p=1020 Version 1.3.4 of SoftHSM has now been released.

  • SOFTHSM-28: Support RSASSA-PSS signature scheme. (Patch from Aleksander Trofimowicz)
  • SOFTHSM-29: The default location of the token database is now $localstatedir/lib/softhsm/

Download the tarball from: softhsm-1.3.4.tar.gz

 

]]> http://www.opendnssec.org/2012/11/26/softhsm-1-3-4/feed/ 0