content-type: text/plain; charset="utf-8"
Content-Disposition: inline
Subject: Re: [ISC-Bugs #43670] Warn on seeing trusted-keys option in config
To: "Mark Andrews via RT" <bind9-confidential@isc.org>
From muks@isc.org  Fri Feb  9 04:36:16 2018
X-Original-To: bind9-confidential@bugs.isc.org
From: "Mukund Sivaraman" <muks@isc.org>
Date: Fri, 9 Feb 2018 10:06:07 +0530
References: <RT-Ticket-43670@isc.org> <rt-4.2.8-6373-1479354393-1893.43670-3-0@isc.org> <20161117035644.E572B5A5BED1@rock.dv.isc.org> <rt-4.2.8-65026-1479355016-990.43670-4-0@isc.org> <20180208190956.GA31608@jurassic> <rt-4.4.1-88210-1518117007-1690.43670-5-0@isc.org> <rt-4.4.1-88210-1518127712-276.43670-5-0@isc.org>
MIME-Version: 1.0
In-Reply-To: <rt-4.4.1-88210-1518127712-276.43670-5-0@isc.org>
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=disabled version=3.4.1
X-RT-Interface: Email
User-Agent: Mutt/1.9.2 (2017-12-15)
Message-ID: <20180209043607.GA5231@jurassic>
RT-Message-ID: <rt-4.4.1-99766-1518150982-299.43670-0-0@isc.org>
Content-Length: 995

On Thu, Feb 08, 2018 at 10:08:32PM +0000, Mark Andrews via RT wrote:
> On Thu Feb 08 09:10:07 2018, muks wrote:
> > On Thu, Nov 17, 2016 at 03:56:57AM +0000, Mark Andrews via RT wrote:
> > > Warning for "." and "dlv.isc.org" when they match the built-in
> > > managed keys would be appropriate.
> > 
> > Somehow this ticket seems to have dropped off the radar.
> > 
> > Please review rt43670.
> > 
> > 		Mukund
> > 
> 
> No!!!  Named is used in private networks where trusted-keys for the root
> is perfectly appropriate.
> 
> dlv.isc.org already has plenty of warnings.
> 
> A warning for a trusted-key for "." which matches the to be removed
> key without the added key already being present would be the point
> where I would issue a warning.  Anything else is going to generate
> noise or is us enforcing our policy ideas on the operator.
> 
> Also all this code should be bin lib/bind9/check.c

OK. I checked the code that was merged and it looks like a better way to
handle it.

		Mukund