CAcert System Admins discussion list

[Philipp Guehring <philipp AT cacert.org>]

Hi,
> So tentatively going ahead at this moment:
>
> Two important questions to be resolved for CAcert's own DNS service:
>
> 1. Who is currently administrating the zone?
>   
Georg Markus Kainz 
(kainz AT coto.at)
 and me.
>    I've obtained the current zone information with an AXFR from one
>    of the current DNS servers (just one of the four configured ones
>    allowed me to do so ...). We need a central location (in SVN or so)
>    where the required zone info is maintained. This could be under
>    control of the critical sysadmin team, but it could also be another
>    team. Propagating changes from the "master" copy to the actual
>    running server should be under control of the critical sysadmin team.
>
> 2. Who should we approach for running a secondary service for the
>    CAcert.org zone?
>   
Matthias Urlichs 
(smurf AT smurf.noris.de)
 is doing that already.
>    For proper DNS service, we need at least one, and preferably two,
>    DNS servers on a different network than CAcert's to run secondary
>    name service for CAcert.org. These servers will obtain the zone file
>    through standard AXFR/IXFR protocol (protected by TSIG), but
>    obviously they need to be considered trustworthy enough by CAcert
>    to do so 
Yes, we have allowed AXFR access on all DNS servers for

netz.smurf.noris.de. Matthias's DNS servers are retreiving the zone 
regularly, backing them up,
and can offer the zone on the whole DNS cluster there in case of a complete 
outage of our primary DNS cluster.



> (a a distant future when the whole world runs DNSSEC,
>    the trustworthiness would be less important since the digital
>    signatures in the zone file would prove the authenticity, but as
>    said that's distant ...).
>   
Yes, shortly after HTTP will be secured by HTTPS. ;-)

Best regards,
Philipp