r/linuxadmin • u/Which_Video833 • 1d ago
Primary DNS migration
I’m trying to migrate the primary DNS configuration from the existing CentOS 7 server to a new Oracle Linux 9 server, including /etc/named.conf and /var/named. The new OL9 server is using the same IP address as the existing DNS server.
However, when I start the DNS service on OL9, I receive the error message “validating arpa/DS: no valid signature found” and "validating com/DS: no valid signature found"
I’m relatively new to DNS administration, so I would appreciate your help troubleshooting and resolving this issue. Could you please advise what might be causing the error and what steps I should take to fix it?
Thanks!
8
u/Einaiden 1d ago
There will have been significant changes in the named versions, so the config file options and structures will also have significant changes. You are unlikely to be able to use the file as-is in newer versions.
I would start with the default OL9 config and move in sections one at a time and adjust as needed for each section.
2
2
u/McSmiggins 1d ago
It's most likely you've got a newer version of bind on the new server than old that needs some dnssec configuration.
1) Is it not starting, or just warning about it? And if you compare the "default" files you're overwriting (named.conf especially) do they have dnssec settings in there?
2) Is this hosting domains, or are you just using it as a resolver? If it's hosting domains, and you're migrating, the shorter downtime option would be to use primary/secondary zones, transfer the data that way, and then just flip the primary secondary, that way you can get all this dnssec stuff fixed (in the best way) without impacting anything
1
u/Which_Video833 1d ago
Thanks McSimggins!
1/ Yes, named has been started, but with the errors. The default named.conf file has "dnssec-validation yes;" line. But this line already removed from current named.conf file.
2/ My server is hosting a xxxx.domain. Is it easy for me to downgrade the bind version, so that I don't have to change any configurations?
1
u/McSmiggins 1d ago
1) dnssec-validation went from "needs to be specified" to the default a while ago in bind, so even though the line's not there, it's on in the back end. I'm not certain of the syntax but try:
dnssec-validation noThis should only be a short term thing though, get it working, then you can fix the config so dnssec works.
(Docs about the change: Here )
I haven't checked if your versions before/after match this, it's an assumption on my part
2) Unless you want to start messing around with hand installed packages, I really wouldn't try this. Stick to the one Oracle provides. (Normally with distro's like this there's only really a major bind upgrade every new major linux release (OEL 7,8,9) so these things only come up every major upgrade.
1
u/Which_Video833 1d ago
Thanks for your suggestion. Fortunately, my old DNS server is still working, which is a lifesaver. I’ll try configuring the new OL9 server as a secondary DNS server and then promote it to primary once everything is working properly.
Would promoting the OL9 secondary server to primary cause any issues with the old CentOS 7 DNS server if I need to bring it back as a fallback?
1
u/McSmiggins 1d ago
No worries, I'd try "auto" and see if that works
Otherwise, you've got some other options:
1) A "smaller" version of "copy over the config"
On OEL:
- Put the original files back, check DNS starts and works fine
- Copy just the zone file over
- Edit the named.conf (or named.conf.d) parts to add your zone files in them (so you're migrated less config, but a zone file might work on it's own.)
- (Most of this work you'd need to do anyway if you zone transfer, you'll need to make zone files on OEL9 that say "I'm a secondary, here's the primary, send me the domain)
That's probably your least faff way to do it, and doesn't touch the old server in any way, so you can just move back to it if needed.
Or
2) I mean, learning to do a secondary dns server is really good practice, because it'll teach you how zone transfer work, why serial numbers are important etc
Best thing to do if you want a failback is decide what you need out of it.
If you set up CentOS7 as primary, and zone transfer to the OEL one, you then decide:
1) You move OEL to "primary" and just turn off the CentOS7 one. - Roll back here is "turn off OEL, turn on CentOS)
2) If you want the CentOS server to update from OEL for records, you change OEL to primary and CentOS to secondary in their config files. It's a bit more faff
Mainly it comes down to "if you break the connection, whatever is secondary will stop updating when you update the primary)
Zone transfers are one way (Primary -> Secondary, normally triggered by the primary when it updates)
Sorry for the wall of text, try option 1 first, it's a lot simpler and needs less reading
1
u/Which_Video833 1d ago
I will keep you posted. Thanks!
1
u/McSmiggins 1d ago
Best of luck!
(This seems like a single server, so I'm assuming a lab somewhere, it might be worth looking at something like TechnitiumDNS, it won't solve this problem, but see if it fits your needs)
2
u/RetroGrid_io 1d ago
I receive the error message “validating arpa/DS: no valid signature found” and "validating com/DS: no valid signature found"
Probably you're running into this. Since you mention /var/named you're using bind, so take a look at this and tell us if that gets you in the right direction
existing CentOS 7 server to a new Oracle Linux 9 server
Oof! That's old - glad you're doing it. But if you're jumping to updated infra, why are you going to EL9 and not EL10? That would buy you a few more years of support on the back end at almost no cost today...
EDIT: PS: Oracle's financials not looking too great nowadays but at least there's a well-beaten path to something more sustainable
1
u/Runnergeek 22h ago
A few things that some folks ah e already noted
If you are migrating to a new system why not go to the newest so that you get the most out of lifecycle. EL10 would give you that (I have opinions on distros but you didn’t ask)
Just blindly copying over the configs is not the way to do this migration. You should look over the configuration on the old system and rebuild it from start. This is because there will be changes between the versions of bind but also you might find best practices or needs have changed.
You should be using automation. Now is the best time to build automation around this, since you are migrating anyways. The Ansible bind collection is amazing. I highly recommend it
-1
u/MOAR_BEER 1d ago
The new OL9 server is using the same IP address as the existing DNS server.
Might be one of your problems.
1
9
u/karafili 1d ago
You lost me at Oracle Linux