Hi again,
It seems named-pkcs11 fails to start because it cannot read PKCS11 objects from the HSM.
Yet, user 'named' is able to access the HSM, at least interactively:
[root@ros-ass-ipa-02 ~]# sudo -u named bash
bash-4.4$ cd
bash-4.4$ export SOFTHSM2_CONF=/etc/ipa/dnssec/softhsm2.conf
bash-4.4$ export SOFTHSM2_PIN="$(cat /var/lib/ipa/dnssec/softhsm_pin)"
bash-4.4$ softhsm2-util --show-slots
Available slots:
Slot 1007503753
Slot info:
Description: SoftHSM slot ID 0x3c0d4989
Manufacturer ID: SoftHSM project
Hardware version: 2.4
Firmware version: 2.4
Token present: yes
Token info:
Manufacturer ID: SoftHSM project
Model: SoftHSM v2
Hardware version: 2.4
Firmware version: 2.4
Serial number: 226b9cd63c0d4989
Initialized: yes
User PIN init.: yes
Label: ipaDNSSEC
Slot 1
Slot info:
Description: SoftHSM slot ID 0x1
Manufacturer ID: SoftHSM project
Hardware version: 2.4
Firmware version: 2.4
Token present: yes
Token info:
Manufacturer ID: SoftHSM project
Model: SoftHSM v2
Hardware version: 2.4
Firmware version: 2.4
Serial number:
Initialized: no
User PIN init.: no
Label:
bash-4.4$ pkcs11-list -p "${SOFTHSM2_PIN}" -s 1007503753
slot 1007503753
object[0]: handle 2 class 3 label[56]
'dnssec-replica:ros-ass-ipa-02.core.ass.ros.ipa.pep06.fr.' id[16]
0xb1fab57b623bf846... E:never
object[1]: handle 3 class 2 label[56]
'dnssec-replica:ros-ass-ipa-02.core.ass.ros.ipa.pep06.fr.' id[16]
0xb1fab57b623bf846...
Of course, specifying a non-existent slot ID returns a terminating error:
bash-4.4$ pkcs11-list -p "${SOFTHSM2_PIN}" -s 0
Unrecoverable error initializing PKCS#11: not found
Unrecoverable error initializing PKCS#11: not found
We can also list PKCS11 tokens:
bash-4.4$ pkcs11-tokens
DEFAULTS
rand_token=0x55ae13fa0180
best_rsa_token=0x55ae13fa0180
best_dsa_token=0x55ae13fa0180
best_dh_token=0x55ae13fa0180
digest_token=0x55ae13fa0180
best_ec_token=0x55ae13fa0180
best_gost_token=(nil)
aes_token=0x55ae13fa0180
TOKEN
address=0x55ae13fa0180
slotID=1007503753
label=ipaDNSSEC
manufacturerID=SoftHSM project
model=SoftHSM v2
serialNumber=226b9cd63c0d4989
supported operations=0x17e (RANDRSA,DSA,DH,DIGEST,EC,AES)
TOKEN
address=0x55ae13fa0320
slotID=1
label=
manufacturerID=SoftHSM project
model=SoftHSM v2
serialNumber=
supported operations=0x17e (RANDRSA,DSA,DH,DIGEST,EC,AES)
File permissions seem OK. Putting SELinux in permissive mode did not help.
What else could prevent BIND from accessing the HSM ?