[Opendnssec-user] dendency wrong in ubuntu packages

[Bas van den Dikkenberg]

Hi,

I use the repo of Ondøej Surý, They work perfect only the problem is I am running in mysql setup for production like opendnssec recommended.
But for the start opendnssec does not depend on MySQL, and there for the start failed. Just do restart and all work like sharm.

May this can be fixed in packeges
don't know if this is an issue for dev team or for Ondøej or both so I send him an cc?

With kind regards,

Bas

[Ondřej Surý]

Hi Bas,

could you please be more precise about what is wrong? Perhaps exact
listing of what is wrong, how do you think it should be fixed and how to
reproduce the issue would be helpful.

Cheers,
--
Ondřej Surý <***@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server
Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware,
fast DNS(SEC) resolver
Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna a potřeby pro
pečení chleba všeho druhu

On Thu, Dec 8, 2016, at 23:25, Bas van den Dikkenberg wrote:
> Hi,
>
> I use the repo of Ondřej Surý, They work perfect only the problem is I am
> running in mysql setup for production like opendnssec recommended.
> But for the start opendnssec does not depend on MySQL, and there for the
> start failed. Just do restart and all work like sharm.
>
> May this can be fixed in packeges
> don't know if this is an issue for dev team or for Ondřej or both so I
> send him an cc?
>
> With kind regards,
>
> Bas
>
>
> _______________________________________________
> Opendnssec-user mailing list
> Opendnssec-***@lists.opendnssec.org
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

[Bas van den Dikkenberg]

I will try :-P

I am dyslectic so i hope i can make you understand:

Because we use the MySQL database we installed the packages : Opendnssec-enforcer-MySQL
Correct ?

The issue now Is that Opendnssec failed to start because MySQL is not up.
So when you install the Opendnssec-enforcer-MySQL there should be made an dependency of some kind to MySQL so it waits for MySQL to started.

Bas


-----Oorspronkelijk bericht-----
Van: Opendnssec-user [mailto:opendnssec-user-***@lists.opendnssec.org] Namens Ondrej Surý
Verzonden: vrijdag 9 december 2016 10:52
Aan: opendnssec-***@lists.opendnssec.org
Onderwerp: Re: [Opendnssec-user] dendency wrong in ubuntu packages

Hi Bas,

could you please be more precise about what is wrong? Perhaps exact listing of what is wrong, how do you think it should be fixed and how to reproduce the issue would be helpful.

Cheers,
--
Ondřej Surý <***@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware, fast DNS(SEC) resolver Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna a potřeby pro pečení chleba všeho druhu

On Thu, Dec 8, 2016, at 23:25, Bas van den Dikkenberg wrote:
> Hi,
>
> I use the repo of Ondřej Surý, They work perfect only the problem is I
> am running in mysql setup for production like opendnssec recommended.
> But for the start opendnssec does not depend on MySQL, and there for
> the start failed. Just do restart and all work like sharm.
>
> May this can be fixed in packeges
> don't know if this is an issue for dev team or for Ondřej or both so
> I send him an cc?
>
> With kind regards,
>
> Bas
>
>
> _______________________________________________
> Opendnssec-user mailing list
> Opendnssec-***@lists.opendnssec.org
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
_______________________________________________
Opendnssec-user mailing list
Opendnssec-***@lists.opendnssec.org
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

[Ondřej Surý]

Hi Bas,

this has to be solved in OpenDNSSEC itself.

While I could in theory add:

Required-Start: $mysql

to init scripts that would only work:

a) if mysqld actually starts to listen before opendnssec is started
(f.e. it could start checking the databases in background, etc.)
(fortunately in this case, the Debian init.d scripts waits for MySQL to
become available)
b) if mysql is running on the same machine

Therefore OpenDNSSEC needs to be able to cope with MySQL not running and
start the daemon, but wait for MySQL to become available before doing
anything, instead of failing.

Also don't think that init daemons generally has option to wait for
MySQL only if MySQL is actually installed. With Debian insserv it would
probably work, because the "Required-Start:" would get probably ignored
if not available. But with upstart or systemd this is not possible and
it's up to the local administrator to configure the daemons to run in
correct order.

Cheers,
--
Ondřej Surý <***@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server
Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware,
fast DNS(SEC) resolver
Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna a potřeby pro
pečení chleba všeho druhu

On Fri, Dec 9, 2016, at 22:59, Bas van den Dikkenberg wrote:
> I will try :-P
>
> I am dyslectic so i hope i can make you understand:
>
> Because we use the MySQL database we installed the packages :
> Opendnssec-enforcer-MySQL
> Correct ?
>
> The issue now Is that Opendnssec failed to start because MySQL is not up.
> So when you install the Opendnssec-enforcer-MySQL there should be made an
> dependency of some kind to MySQL so it waits for MySQL to started.
>
> Bas
>
>
> -----Oorspronkelijk bericht-----
> Van: Opendnssec-user
> [mailto:opendnssec-user-***@lists.opendnssec.org] Namens Ondrej Surý
> Verzonden: vrijdag 9 december 2016 10:52
> Aan: opendnssec-***@lists.opendnssec.org
> Onderwerp: Re: [Opendnssec-user] dendency wrong in ubuntu packages
>
> Hi Bas,
>
> could you please be more precise about what is wrong? Perhaps exact
> listing of what is wrong, how do you think it should be fixed and how to
> reproduce the issue would be helpful.
>
> Cheers,
> --
> Ondřej Surý <***@sury.org>
> Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server Knot
> Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware, fast
> DNS(SEC) resolver Vše pro chleba (https://vseprochleba.cz) – Mouky ze
> mlýna a potřeby pro pečení chleba všeho druhu
>
> On Thu, Dec 8, 2016, at 23:25, Bas van den Dikkenberg wrote:
> > Hi,
> >
> > I use the repo of Ondřej Surý, They work perfect only the problem is I
> > am running in mysql setup for production like opendnssec recommended.
> > But for the start opendnssec does not depend on MySQL, and there for
> > the start failed. Just do restart and all work like sharm.
> >
> > May this can be fixed in packeges
> > don't know if this is an issue for dev team or for Ondřej or both so
> > I send him an cc?
> >
> > With kind regards,
> >
> > Bas
> >
> >
> > _______________________________________________
> > Opendnssec-user mailing list
> > Opendnssec-***@lists.opendnssec.org
> > https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
> _______________________________________________
> Opendnssec-user mailing list
> Opendnssec-***@lists.opendnssec.org
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

[Yuri Schaeffer]

Hi Ondřej,

> this has to be solved in OpenDNSSEC itself.

Forgive me my ignorance but I always thought making sure mounts,
network, services or other dependencies are available is _exactly_ the
problem init systems are supposed to tackle. Is that not how it works?

Is it unreasonable for OpenDNSSEC to require certain resources to be
available before starting?

Best regards,
Yuri

[Ondřej Surý]

On Mon, Dec 12, 2016, at 21:08, Yuri Schaeffer wrote:
> Hi Ondřej,
>
> > this has to be solved in OpenDNSSEC itself.
>
> Forgive me my ignorance but I always thought making sure mounts,
> network, services or other dependencies are available is _exactly_ the
> problem init systems are supposed to tackle. Is that not how it works?

networks, mounts are ok, but how you are going to make sure that
a remote MySQL server is available from within a local init system?

> Is it unreasonable for OpenDNSSEC to require certain resources to be
> available before starting?

With remote MySQL you cannot be even sure that MySQL is available
for a full run time of OpenDNSSEC, as there might be network breakages,
database might disconnect you due to capacity reasons, etc., the server
might be located after a HA proxy not handling TCP connection handovers.

So any software that rely on another networking server must be able
to cope with unavailability of the networked service.

E.g. instead of failing to start when MySQL is not available, it should
refuse to run the first operation in the queue until it is connected,
etc.

Cheers,
--
Ondřej Surý <***@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server
Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware,
fast DNS(SEC) resolver
Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna a potřeby pro
pečení chleba všeho druhu

[Bas van den Dikkenberg]

I also found a another issue the name of the init script is to long see:

***@myserver:~# /etc/init.d/opendnssec-enforcer restart
* Restarting OpenDNSSEC Enforcer opendnssec-enforcer start-stop-daemon: warning: this system is not able to track process names
longer than 15 characters, please use --exec instead of --name.

would be an idea to rename te init script ods-enforcer en ods-signer just like the commands ?


-----Oorspronkelijk bericht-----
Van: Opendnssec-user [mailto:opendnssec-user-***@lists.opendnssec.org] Namens Ondrej Surý
Verzonden: dinsdag 13 december 2016 17:12
Aan: opendnssec-***@lists.opendnssec.org
Onderwerp: Re: [Opendnssec-user] dendency wrong in ubuntu packages

On Mon, Dec 12, 2016, at 21:08, Yuri Schaeffer wrote:
> Hi Ondřej,
>
> > this has to be solved in OpenDNSSEC itself.
>
> Forgive me my ignorance but I always thought making sure mounts,
> network, services or other dependencies are available is _exactly_ the
> problem init systems are supposed to tackle. Is that not how it works?

networks, mounts are ok, but how you are going to make sure that a remote MySQL server is available from within a local init system?

> Is it unreasonable for OpenDNSSEC to require certain resources to be
> available before starting?

With remote MySQL you cannot be even sure that MySQL is available for a full run time of OpenDNSSEC, as there might be network breakages, database might disconnect you due to capacity reasons, etc., the server might be located after a HA proxy not handling TCP connection handovers.

So any software that rely on another networking server must be able to cope with unavailability of the networked service.

E.g. instead of failing to start when MySQL is not available, it should refuse to run the first operation in the queue until it is connected, etc.

Cheers,
--
Ondřej Surý <***@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware, fast DNS(SEC) resolver Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna a potřeby pro pečení chleba všeho druhu _______________________________________________
Opendnssec-user mailing list
Opendnssec-***@lists.opendnssec.org
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

[Ondřej Surý]

No, the init script name is not the issue here. I'll look into it though.


On 13 December 2016 17:34:19 Bas van den Dikkenberg <***@Dikkenberg.net> wrote:

> I also found a another issue the name of the init script is to long see:
>
> ***@myserver:~# /etc/init.d/opendnssec-enforcer restart
> * Restarting OpenDNSSEC Enforcer opendnssec-enforcer
>
>
> start-stop-daemon: warning: this system is not able to track
> process names
> longer than 15 characters, please use --exec instead of --name.
>
> would be an idea to rename te init script ods-enforcer en ods-signer just
> like the commands ?
>
>
> -----Oorspronkelijk bericht-----
> Van: Opendnssec-user [mailto:opendnssec-user-***@lists.opendnssec.org]
> Namens Ondrej Surý
> Verzonden: dinsdag 13 december 2016 17:12
> Aan: opendnssec-***@lists.opendnssec.org
> Onderwerp: Re: [Opendnssec-user] dendency wrong in ubuntu packages
>
> On Mon, Dec 12, 2016, at 21:08, Yuri Schaeffer wrote:
>> Hi Ondřej,
>>
>> > this has to be solved in OpenDNSSEC itself.
>>
>> Forgive me my ignorance but I always thought making sure mounts,
>> network, services or other dependencies are available is _exactly_ the
>> problem init systems are supposed to tackle. Is that not how it works?
>
> networks, mounts are ok, but how you are going to make sure that a remote
> MySQL server is available from within a local init system?
>
>> Is it unreasonable for OpenDNSSEC to require certain resources to be
>> available before starting?
>
> With remote MySQL you cannot be even sure that MySQL is available for a
> full run time of OpenDNSSEC, as there might be network breakages, database
> might disconnect you due to capacity reasons, etc., the server might be
> located after a HA proxy not handling TCP connection handovers.
>
> So any software that rely on another networking server must be able to cope
> with unavailability of the networked service.
>
> E.g. instead of failing to start when MySQL is not available, it should
> refuse to run the first operation in the queue until it is connected, etc.
>
> Cheers,
> --
> Ondřej Surý <***@sury.org>
> Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server Knot
> Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware, fast
> DNS(SEC) resolver Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna
> a potřeby pro pečení chleba všeho druhu
> _______________________________________________
> Opendnssec-user mailing list
> Opendnssec-***@lists.opendnssec.org
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

[Paul Wouters]

On Tue, 13 Dec 2016, Ondřej Surý wrote:

>
> No, the init script name is not the issue here. I'll look into it though.
>
>
> On 13 December 2016 17:34:19 Bas van den Dikkenberg <***@Dikkenberg.net>
> wrote:
>
>> I also found a another issue the name of the init script is to long see:
>>
>> ***@myserver:~# /etc/init.d/opendnssec-enforcer restart
>> * Restarting OpenDNSSEC Enforcer opendnssec-enforcer
>>
>>
>> start-stop-daemon: warning: this system is not able to track
>> process names
>> longer than 15 characters, please use --exec instead of --name.
>>
>> would be an idea to rename te init script ods-enforcer en ods-signer just
>> like the commands ?

Note fedora/rhel uses ods-enforcerd and ods-signerd.

Paul

[Bas van den Dikkenberg]

Isn't idea to make it in all distros the same

Bas



On Wed, Dec 14, 2016 at 6:37 PM +0100, "Paul Wouters" <***@nohats.ca<mailto:***@nohats.ca>> wrote:

On Tue, 13 Dec 2016, Ondøej Surý wrote:

>
> No, the init script name is not the issue here. I'll look into it though.
>
>
> On 13 December 2016 17:34:19 Bas van den Dikkenberg <***@Dikkenberg.net>
> wrote:
>
>> I also found a another issue the name of the init script is to long see:
>>
>> ***@myserver:~# /etc/init.d/opendnssec-enforcer restart
>> * Restarting OpenDNSSEC Enforcer opendnssec-enforcer
>>
>>
>> start-stop-daemon: warning: this system is not able to track
>> process names
>> longer than 15 characters, please use --exec instead of --name.
>>
>> would be an idea to rename te init script ods-enforcer en ods-signer just
>> like the commands ?

Note fedora/rhel uses ods-enforcerd and ods-signerd.

Paul

[Ondřej Surý]

No. This would just break experience for all existing users just for
esthetics... Renaming to wouldn't have any other effect.

O.


On 14 December 2016 19:33:19 Bas van den Dikkenberg <***@Dikkenberg.net> wrote:

>
> Isn't idea to make it in all distros the same
>
> Bas
>
>
>
> On Wed, Dec 14, 2016 at 6:37 PM +0100, "Paul Wouters"
> <***@nohats.ca<mailto:***@nohats.ca>> wrote:
>
> On Tue, 13 Dec 2016, Ondřej SurÃœ wrote:
>
>>
>> No, the init script name is not the issue here. I'll look into it though.
>>
>>
>> On 13 December 2016 17:34:19 Bas van den Dikkenberg <***@Dikkenberg.net>
>> wrote:
>>
>>> I also found a another issue the name of the init script is to long see:
>>>
>>> ***@myserver:~# /etc/init.d/opendnssec-enforcer restart
>>> * Restarting OpenDNSSEC Enforcer opendnssec-enforcer
>>>
>>>
>>> start-stop-daemon: warning: this system is not able to track
>>> process names
>>> longer than 15 characters, please use --exec instead of --name.
>>>
>>> would be an idea to rename te init script ods-enforcer en ods-signer just
>>> like the commands ?
>
> Note fedora/rhel uses ods-enforcerd and ods-signerd.
>
> Paul

[Bas van den Dikkenberg]

If you add:

Wants= mysql.service
After= mysql.service

To the /etc/systemd/system/multi-user.target.wants/opendnssec-enforcer.service

It wil make sure that mysql start before opendnssec-enforcer

If mysql server is not installed on the machine it ignores the line .

So this would fixed the issue

Bas



-----Oorspronkelijk bericht-----
Van: Ondřej Surý [mailto:***@sury.org]
Verzonden: dinsdag 13 december 2016 18:03
Aan: Bas van den Dikkenberg <***@Dikkenberg.net>; opendnssec-***@lists.opendnssec.org
Onderwerp: RE: [Opendnssec-user] dendency wrong in ubuntu packages

No, the init script name is not the issue here. I'll look into it though.


On 13 December 2016 17:34:19 Bas van den Dikkenberg <***@Dikkenberg.net> wrote:

> I also found a another issue the name of the init script is to long see:
>
> ***@myserver:~# /etc/init.d/opendnssec-enforcer restart
> * Restarting OpenDNSSEC Enforcer opendnssec-enforcer
>
>
> start-stop-daemon: warning: this system is not able to track
> process names longer than 15 characters, please use --exec instead of
> --name.
>
> would be an idea to rename te init script ods-enforcer en ods-signer
> just like the commands ?
>
>
> -----Oorspronkelijk bericht-----
> Van: Opendnssec-user
> [mailto:opendnssec-user-***@lists.opendnssec.org]
> Namens Ondrej Surý
> Verzonden: dinsdag 13 december 2016 17:12
> Aan: opendnssec-***@lists.opendnssec.org
> Onderwerp: Re: [Opendnssec-user] dendency wrong in ubuntu packages
>
> On Mon, Dec 12, 2016, at 21:08, Yuri Schaeffer wrote:
>> Hi Ondřej,
>>
>> > this has to be solved in OpenDNSSEC itself.
>>
>> Forgive me my ignorance but I always thought making sure mounts,
>> network, services or other dependencies are available is _exactly_
>> the problem init systems are supposed to tackle. Is that not how it works?
>
> networks, mounts are ok, but how you are going to make sure that a
> remote MySQL server is available from within a local init system?
>
>> Is it unreasonable for OpenDNSSEC to require certain resources to be
>> available before starting?
>
> With remote MySQL you cannot be even sure that MySQL is available for
> a full run time of OpenDNSSEC, as there might be network breakages,
> database might disconnect you due to capacity reasons, etc., the
> server might be located after a HA proxy not handling TCP connection handovers.
>
> So any software that rely on another networking server must be able to
> cope with unavailability of the networked service.
>
> E.g. instead of failing to start when MySQL is not available, it
> should refuse to run the first operation in the queue until it is connected, etc.
>
> Cheers,
> --
> Ondřej Surý <***@sury.org>
> Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server
> Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware,
> fast
> DNS(SEC) resolver Vše pro chleba (https://vseprochleba.cz) – Mouky ze
> mlýna a potřeby pro pečení chleba všeho druhu
> _______________________________________________
> Opendnssec-user mailing list
> Opendnssec-***@lists.opendnssec.org
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

[Paul Wouters]

On Tue, 13 Dec 2016, Ondřej Surý wrote:

> E.g. instead of failing to start when MySQL is not available, it should
> refuse to run the first operation in the queue until it is connected,
> etc.

+1

Also, runtime linking support for mysql versus sql would be a great
improvement so packages don't need to make multiple packets (like
Ondřej did) or pick one (sqlite, like I did)

Paul

[Ondřej Surý]

On Tue, Dec 13, 2016, at 17:28, Paul Wouters wrote:
> On Tue, 13 Dec 2016, Ondřej Surý wrote:
>
> > E.g. instead of failing to start when MySQL is not available, it should
> > refuse to run the first operation in the queue until it is connected,
> > etc.
>
> +1
>
> Also, runtime linking support for mysql versus sql would be a great
> improvement so packages don't need to make multiple packets (like
> Ondřej did) or pick one (sqlite, like I did)

In this case, I would be even happy if the enforcer was linked to both
libraries at the same time, and the choice of database backend would be
configurable. OpenDNSSEC is heavyweight daemon, so it's not expected to
run in constrained environment, thus pulling one extra database library
(either libmariadb or libsqlite3) poses no problem.

Adding pluggable database libraries would be nice, but I don't think the
usefulness in this case outweights the additional complexity.

Cheers,
--
Ondřej Surý <***@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server
Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware,
fast DNS(SEC) resolver
Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna a potřeby pro
pečení chleba všeho druhu

[Jaap Akkerhuis]

Ondřej Surý writes:

> networks, mounts are ok, but how you are going to make sure that a
> remote MySQL server is available from within a local init system?
>
> > Is it unreasonable for OpenDNSSEC to require certain resources to be
> > available before starting?
>
> With remote MySQL you cannot be even sure that MySQL is available for
> a full run time of OpenDNSSEC, as there might be network breakages,
> database might disconnect you due to capacity reasons, etc., the
> server might be located after a HA proxy not handling TCP connection
> handovers.
>
> So any software that rely on another networking server must be able to
> cope with unavailability of the networked service.
>
> E.g. instead of failing to start when MySQL is not available, it
> should refuse to run the first operation in the queue until it is
> connected, etc.

So you are saing that it should try to connect to the database and
other need resources if any, before it becomes functional.

jaap

[Ondřej Surý]

On Wed, Dec 14, 2016, at 08:40, Jaap Akkerhuis wrote:
> Ondřej Surý writes:
>
> > networks, mounts are ok, but how you are going to make sure that a
> > remote MySQL server is available from within a local init system?
> >
> > > Is it unreasonable for OpenDNSSEC to require certain resources to be
> > > available before starting?
> >
> > With remote MySQL you cannot be even sure that MySQL is available for
> > a full run time of OpenDNSSEC, as there might be network breakages,
> > database might disconnect you due to capacity reasons, etc., the
> > server might be located after a HA proxy not handling TCP connection
> > handovers.
> >
> > So any software that rely on another networking server must be able to
> > cope with unavailability of the networked service.
> >
> > E.g. instead of failing to start when MySQL is not available, it
> > should refuse to run the first operation in the queue until it is
> > connected, etc.
>
> So you are saing that it should try to connect to the database and
> other need resources if any, before it becomes functional.

I think I am saying the exact opposite :), or we just don't understand
each other.

What I am trying to say is that every database operation should be
blocking (with timeout) and it should include "connect/reconnect"
operation.

Thus in case of opendnssec-signer, the signerd should start, enter the
main loop and try to connect to database only after it needs to. If the
database connection fails, it should report the error and back off for
some predefined time, and try to connect again.

Cheers,
--
Ondřej Surý <***@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server
Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware,
fast DNS(SEC) resolver
Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna a potřeby pro
pečení chleba všeho druhu