to be fully automated in zones configured for
dynamic DNS. 'auto-dnssec allow;' permits a zone
to be signed by creating keys for it in the
key-directory and using 'rndc sign <zone>'.
'auto-dnssec maintain;' allows that too, plus it
also keeps the zone's DNSSEC keys up to date
according to their timing metadata. [RT #19943]
validation from rndc. This is useful for the
mobile hosts where the current connection point
breaks DNSSEC (firewall/proxy). [RT #15592]
rndc validation newstate [view]
replay protection requires both rndc and named to
be updated. Partial replay protection (limited
exposure after restart) is provided if just named
is updated.
states.
1378. [func] Improved positive feedback for 'rndc {reload|refresh}.
1377. [func] dns_zone_load{new}() now reports if the zone was
loaded, queued for loading to up to date.
1376. [func] New function dns_zone_logc() to log to specified
category.
[RT #2394]
Basically, "freeze" disables dynamic updates to a zone, syncs the journal
file into the master file, and removes the journal. This allows manual
edits of a dynamic zone file without stopping the server, since the
zone is temporarily considered non-dynamic. "unfreeze" re-enables dynamic
updates to a zone.
So, instead of the old:
rndc stop
edit master file
remove journal
restart server
you can now do:
rndc freeze zone
edit master file
rndc reload zone
rndc unfreeze zone
which doesn't require stopping the server.
About everyone here at the secure dynamic update workshop wanted this.
It will be documented soon.
Evan Hunt
Automatic Updater
Mark Andrews
Rob Austein
Michael Graff