replay protection requires both rndc and named to
be updated. Partial replay protection (limited
exposure after restart) is provided if just named
is updated.
states.
1378. [func] Improved positive feedback for 'rndc {reload|refresh}.
1377. [func] dns_zone_load{new}() now reports if the zone was
loaded, queued for loading to up to date.
1376. [func] New function dns_zone_logc() to log to specified
category.
[RT #2394]
Basically, "freeze" disables dynamic updates to a zone, syncs the journal
file into the master file, and removes the journal. This allows manual
edits of a dynamic zone file without stopping the server, since the
zone is temporarily considered non-dynamic. "unfreeze" re-enables dynamic
updates to a zone.
So, instead of the old:
rndc stop
edit master file
remove journal
restart server
you can now do:
rndc freeze zone
edit master file
rndc reload zone
rndc unfreeze zone
which doesn't require stopping the server.
About everyone here at the secure dynamic update workshop wanted this.
It will be documented soon.
