ubuntuusers.de

resolve call failed: DNSSEC validation failed: no-signature

Status: Gelöst | Ubuntu-Version: Ubuntu 17.04 (Zesty Zapus)
Antworten |

chefbob

Anmeldungsdatum:
5. November 2016

Beiträge: 8

Hallo,

ich habe eben von network-manager auf systemd umgestellt. Es klappt alles bis auf die Namensauflösung (ping). Habt Ihr eine Idee warum ich einen DNSSEC Fehler bekomme?

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

root@workstation:/home/myuser# cat /etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=17.04
DISTRIB_CODENAME=zesty
DISTRIB_DESCRIPTION="Ubuntu Zesty Zapus (development branch)"


Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question mynetwork.lan IN DS: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question mynetwork.lan IN SOA: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question monitoring.mynetwork.lan IN DS: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question monitoring.mynetwork.lan IN SOA: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question monitoring.mynetwork.lan IN A: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question mynetwork.lan IN DS: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question mynetwork.lan IN SOA: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question monitoring.mynetwork.lan IN DS: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question monitoring.mynetwork.lan IN SOA: no-signature
Dec  4 17:32:28 workstation systemd-resolved[8115]: DNSSEC validation failed for question monitoring.mynetwork.lan IN A: no-signature


root@workstation:/home/myuser# systemd-resolve monitoring.mynetwork.lan
monitoring.mynetwork.lan: resolve call failed: DNSSEC validation failed: no-signature


root@workstation:/home/myuser# cat /etc/resolv.conf 
# This file is managed by systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known DNS servers.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 192.168.2.134

root@workstation:/home/myuser# cat /etc/systemd/resolved.conf 
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See resolved.conf(5) for details

[Resolve]
DNS=192.168.2.134
#FallbackDNS=8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844
#Domains=
#LLMNR=yes
#DNSSEC=allow-downgrade
#Cache=yes
#DNSStubListener=udp

root@workstation:/home/myuser# ping monitoring.mynetwork.lan
ping: monitoring.mynetwork.lan: Name or service not known
root@workstation:/home/myuser# dig monitoring.mynetwork.lan

; <<>> DiG 9.10.3-P4-Ubuntu <<>> monitoring.mynetwork.lan
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50371
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;monitoring.mynetwork.lan.	IN	A

;; ANSWER SECTION:
monitoring.mynetwork.lan. 300	IN	A	192.168.2.132

;; AUTHORITY SECTION:
mynetwork.lan.	300	IN	NS	dns01.mynetwork.lan.

;; ADDITIONAL SECTION:
dns01.mynetwork.lan.	300	IN	A	192.168.2.134

;; Query time: 0 msec
;; SERVER: 192.168.2.134#53(192.168.2.134)
;; WHEN: Sun Dec 04 17:48:48 CET 2016
;; MSG SIZE  rcvd: 107

Bearbeitet von rklm:

Version korrigiert

encbladexp Team-Icon

Ehemaliger
Avatar von encbladexp

Anmeldungsdatum:
16. Februar 2007

Beiträge: 17524

Du verwendest eine Alpha/Beta Version von Ubuntu, dort scheint schon systemd-resolved genutzt zu werden für die Namensauflösung. Und der probiert sein Glück eben mit DNSSEC für eine nicht mit DNSSEC geschützte Domain. In der resolved.conf kannst du dies mit DNSSEC=off erstmal abschalten, dann probiert er sein Glück nicht mehr damit.

Eine andere Lösung ist über /etc/nsswitch.conf kein resolved mehr zu verwenden.

mfg Stefan Betz

chefbob

(Themenstarter)

Anmeldungsdatum:
5. November 2016

Beiträge: 8

Vielen Dank! Dank DNSSEC=off geht es jetzt

encbladexp Team-Icon

Ehemaliger
Avatar von encbladexp

Anmeldungsdatum:
16. Februar 2007

Beiträge: 17524

Perfekt, und das nächste mal dann unten am Thread einfach "Als gelöst markieren" klicken. Hab ich jetzt für dich fix gemacht 😉

mfg Stefan Betz

Antworten |