Start restructuring for Pelican

1 files changed, 0 insertions, 136 deletions

diff --git a/tracwiki/OpenDNSSEC.trac b/tracwiki/OpenDNSSEC.trac
deleted file mode 100644
index 1526a29..0000000
--- a/tracwiki/OpenDNSSEC.trac
+++ /dev/null
@@ -1,136 +0,0 @@
-= DNSSEC signing using OpenDNSSEC and a Cryptech alpha board rev03 =

-

-== Before you start, you'll need ==

-

-- A Cryptech Alpha board, preferrably revision "rev03"

-- APT on the host system configured to find packages in the Cryptech

-  repository, see BinaryPackages for instructions

-

-{{{

-apt-get install cryptech-alpha opendnssec opensc

-}}}

-

-Once you have the software package installed, you may need to [wiki:Upgrading upgrade your HSM's firmware].

-

-== Configure the HSM ==

-

-For now, connect USB cables to both the DATA and MGMT ports of your HSM and plug them into the host where you will be running OpenDNSSEC.

-In production use it should not be necessary to leave the MGMT port connected, but it's easier to set up this way, and, as this is still a development platform, this is the configuration that's gotten the most testing.

-

-{{{

-# eval $(cryptech_probe)

-# cryptech_muxd &

-# cryptech_console

-

-Username: wheel

-Password: YouReallyNeedToChangeThisPINRightNowWeAreNotKidding

-

-cryptech> keystore set pin wheel supersikritnewpw

-cryptech> keystore set pin so 123456

-cryptech> keystore set pin user 1234

-

-cryptech> masterkey set EFBEADDE

-^C

-}}}

-

-Leave `cryptech_muxd` running, so that the PKCS !#11 library can use it to talk to the HSM.

-

-

-== Configure OpenDNSSEC ==

-

-{{{

-mkdir /var/lib/opendnssec/cryptech

-

-cat > /var/lib/opendnssec/unsigned/example.com << EOF

-\$TTL 600

-example.com.  IN SOA  hidden-master.example.com. hostmaster.example.com. (

-                                2016041401 ; serial

-                                720        ; 28800      ; refresh (8 hours)

-                                720        ; 7200       ; retry (2 hours)

-                                300        ; 604800     ; expire (1 week)

-                                120        ; 3600       ; minimum (1 hour)

-                                )

-

-               NS      lab.cryptech.is.

-test           A       127.0.0.1

-EOF

-

-chown -R opendnssec: /var/lib/opendnssec/*

-}}}

-

-

-== OpenDNSSEC configuration changes ==

-

-/etc/opendnssec/conf.xml:

-

-{{{

-<Repository name="Cryptech">

-        <Module>/usr/lib/libcryptech-pkcs11.so</Module>

-        <TokenLabel>Cryptech Token</TokenLabel>

-        <PIN>1234</PIN>

-        <SkipPublicKey/>

-</Repository>

-}}}

-

-The PIN is whatever was chosen as PIN for 'user' above.

-The !TokenLabel has to be "Cryptech Token", not something you choose.

-

-

-/etc/opendnssec/kasp.xml:

-

-    s/SoftHSM/Cryptech/

-

-/etc/opendnssec/zonelist.xml:

-

-{{{

-<Zone name="example.com">

-        <Policy>lab</Policy>

-        <SignerConfiguration>/var/lib/opendnssec/signconf/example.com.xml</SignerConfiguration>

-        <Adapters>

-                <Input>

-                        <Adapter type="File">/var/lib/opendnssec/unsigned/example.com</Adapter>

-                </Input>

-                <Output>

-                        <Adapter type="File">/var/lib/opendnssec/signed/example.com</Adapter>

-                </Output>

-        </Adapters>

-</Zone>

-}}}

-

-

-== Initialization and signing ==

-

-Make the deamons reload their configuration:

-

-{{{

-    service opendnssec-enforcer restart

-    service opendnssec-signer restart

-}}}

-

-Initialize opendnssec:

-

-{{{

-    ods-ksmutil setup

-}}}

-

-That should be it!

-

-See /var/log/syslog for output from ods-kaspcheck, ods-enforcerd and ods-signerd.

-See /var/lib/opendnssec/signed/ for a signed example.com zone.

-

-To list keys using ods-ksmutil, accessing the HSM using pkcs11

-directly (rather than going through any of the opendnssec daemons),

-export the environment variables from /etc/default/opendnssec and run

-"ods-ksmutil keys list --verbose":

-

-{{{

-# ods-ksmutil keys list --verbose

-SQLite database set to: /var/lib/opendnssec/kasp.db

-Keys:

-Zone:                           Keytype:      State:    Date of next transition (to):  Size:   Algorithm:  CKA_ID:                           Repository:                       Keytag:

-example.com                     KSK           ready     waiting for ds-seen (active)   2048    8           7f9b9329480ebe5dc81054ccb293e261  Cryptech                          62642

-example.com                     ZSK           active    2016-07-13 19:04:30 (retire)   1024    8           97e972633613bd605944a0531ff5399b  Cryptech                          56620

-}}}

-

-If the output for repository is "Cryptech NOT IN repository",

-ods-ksmutil has not been able to actually list the keys in the HSM.
\ No newline at end of file