<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">On 08 Nov 2024, at 13:34, Yorgos Thessalonikefs via Unbound-users <unbound-users@lists.nlnetlabs.nl> wrote:<div><br><div><blockquote type="cite">I **think** you are hitting the system wide policies in RH9 that SHA1 is disabled by default.<br><div><div><br>Can you try the suggestion on this link to bring it back?<br>https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#proc_re-enabling-sha-1_using-the-system-wide-cryptographic-policies<br><br>Since the zone is only signed with algorithm 7 (RSASHA1-NSEC3-SHA1), Unbound cannot validate it and instead treats it as insecure.<br>That is why you get all the records back and no AD bit.<br></div></div></blockquote><div><br></div><div>Went back to check this, and the current setting on the machine is LEGACY, so in theory SHA1 should still work.</div><div><br></div><div><p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal;"><span style="font-variant-ligatures: no-common-ligatures">[root@seawitch unbound]# update-crypto-policies --show</span></p>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal;"><span style="font-variant-ligatures: no-common-ligatures">LEGACY</span></p><div><span style="font-variant-ligatures: no-common-ligatures"><br></span></div></div><div>I then tried to build a completely vanilla unbound v1.22.0, yet this version fails to start complaining about:</div><div><br></div><div>fatal error: could not open autotrust file for writing, /root.key.10018-0-16059b0: Permission denied</div><div><br></div><div>The path /root.key.10018-0-16059b0 is weird - I would have expected it to be relative to the "/usr/local/etc/unbound/root.key" value, but somehow "/" is hardcoded somewhere in the code.</div><div><br></div><div>Regards,</div><div>Graham</div><div>--</div><div><br></div></div></div></body></html>