Re: The problem I see with DNSSEC as a potential end user and administrator.

[Ralf Weber <[e-mail]>]

Moin!

On Aug 8, 2008, at 11:52 , Ondřej Surý wrote:
> Well, we don't need to sell it to masses.  We just need to educated  
> registrars,
> ISPs and big zone hosters, where people with (at least some) clue  
> works.
Well even these guys (I think my company is in one of the above  
mentioned business ;-) want tools that don't put to much operational  
burden on them. So a switch or checkbox that says DNSSEC enabled for  
that zone, and does all the rest in background (KSK, ZSK generation,  
zone signing and resigning, ZSK rollover, KSK rollover) is something  
that we  and I guess others want. Ok for KSK it would be good if it  
offer to access it via an external storage that you only attach to the  
box at certain times to not have always on the box and at risk being  
compromised. And we do want it in an integrated manner and not as a  
bunch of different toolsets that you can stick together.

So far I know of no solution that does offer that, but if anyone knows  
tell me.

> And that's something what we are working on.
You can try, but I guess you will have problems when the operational  
overhead is bigger than the potential benefit.

So long
-Ralf
---
Ralf Weber
Platform Infrastructure Manager
Colt Telecom GmbH
Herriotstrasse 4
60528 Frankfurt
Germany
DDI: [phone] Internal OneDial: 8 491 2780
Fax: [phone]
Email: [e-mail]
http://www.colt.net/

Data | Voice | Managed Services

*****************************************
COLT Telecom GmbH, Herriotstraße 4, 60528 Frankfurt/Main, Deutschland *
Tel [phone] * Fax [phone] *
Geschäftsführer: Albertus Marinus Oosterom (Vors.), Rita Thies *
Amtsgericht Frankfurt/Main HRB 53898 * USt.-IdNr. DE 220 772 475



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>