Bug 693788

Summary:	bind97 doesn't contain root zone DNSKEY
Product:	Red Hat Enterprise Linux 5	Reporter:	Steve Snyder <swsnyder>
Component:	bind97	Assignee:	Adam Tkac <atkac>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	5.6	CC:	azelinka, ovasik
Target Milestone:	rc	Keywords:	ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-01-08 04:05:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	695382

Description Steve Snyder 2011-04-05 15:11:52 UTC

Description of problem:

The current package of bind97 contains file "named.iscdlv.key" which is out-dated, and doesn't reflect the keys of the root zone.  This file should be replaced with this one:

http://ftp.isc.org/isc/bind9/keys/9.7/bind.keys.v9_7

Version-Release number of selected component (if applicable):

bind97-9.7.0-6.P2.el5

How reproducible:

Always

Steps to Reproduce:
1. Use current bind97 package in DNSSEC configuration
2. Note complaints in the BIND logs about the root zone being unsigned
  
Actual results:

Lots of log entries with this format:

dnssec: validating @0x9a3f280: . NSEC: no valid signature found
dnssec: validating @0x9a3f280: . SOA: no valid signature found

Expected results:

BIND package should be able to correct validate the root zone.

Additional info:

http://www.isc.org/community/blog/201007/using-root-dnssec-key-bind-9-resolvers

Comment 12 errata-xmlrpc 2013-01-08 04:05:33 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0043.html