https://www.danube.cloud | https://github.com/erigones/esdc-ce/wiki/Release-Notes
i recommend creating a key outside and just import it into the sandbox
but it always complains about a secret key
so no way to sign for the moment
outside the sandbox i can see the secret key
but inside the sandbox it gives me the following error
gpg2 --list-secret-keys
gpg: NOTE: trustdb not writable
gpg: NOTE: trustdb not writable
try adding
--no-default-keyring --keyring /opt/local/etc/gnupg/pkgsrc.gpg
--no-default-keyring --keyring /opt/local/etc/gnupg/pkgsrc.gpg
and also with the private key import command
gpg2 --no-default-keyring --keyring /opt/local/etc/gnupg/pkgsrc.gpg
gpg: Go ahead and type your message ...
gpg: Go ahead and type your message ...
still waiting
I don't remember exactly… it was always pain to setup it… so I try to avoid doing it by keeping the same env running as long as possible
gpg --list-secret-keys --no-default-keyring --keyring /opt/local/etc/gnupg/pkgsrc.gpg
gpg --list-secret-keys --no-default-keyring --keyring /opt/local/etc/gnupg/pkgsrc.gpg
gpg --no-default-keyring --keyring /opt/local/etc/gnupg/pkgsrc.gpg --import secretkey.asc
not sure what's going on
and tried to run sandbox with that /root/.gpg as RW then it does not boot the sandbox
but running outside the sandbox i see the keys and secrets
either something has changed since I did it last time or there's something wrong
so did everything in gpg2
but even with gpg it still gives me the same error
tried both
ok, now I'm officially out of ideas. Maybe try to start over with older zone. Last zone I've set up from scratch was 2018Q4 (official smartos compile image).
thanks
After moving to dns02 when dns01 died with the server, I realized that my dns01 had some custom settings, which I have to reproduce. I have 2 public bind9 servers which serve all my zones to the public. I've just made pdns to forcefully notify them both of all changes and allow them to query axfr after that. It's simple and versatile way to spread all zones to own nameservers. Maybe it's worth making configurrable options in DC for allow-axfr-ips, also-notify. And also I had to change db connection to the vIPб because by defail it was pointed to mgmt01.
So bringing up dns02 machine isn't just setting metadata and run from image though. =)
BTW, yanchii , What I have to change if I swapping the motherboard? Only change MAC addresses in /usbkey/config ?
you're probably lucky… I've implemented zone transfers in latest DC version :)
I won't say Danube cloud / SmartOS is more secure, but the above news surely gives us back some credits for not using the manstream VM providers 🤭
Solaris had very good security… AFAIK no break out of the zone was ever discovered