> I configure bind to serve "example.com" domain with
>
> 1. dnssec-enable yes;
> 2. auto-dnssec maintain;
> 3. inline-signing yes;
> 4. allow-update{localhost;};
>
> Bind can fully automatic dnssec signing on example.com but If I want to
> modify a record in example.com zone in the zone's file directly without
> using nsupdate for dynamic zone.
>
> How can I force bind to read from the modified zone's file and sign it
> immediately like manual signing in an older version.
The same as without any dnssec at all - edit the zonefile (including
increasing the serial number), and call 'rndc reload example.com'. The
signed version of the zone will be updated as required - existing
signatures that are still valid won't be replaced (unless they expire
soon, etc, etc)
However, the 'allow-update' stanza makes me wonder whether you're mixing
dynamic updates with manual zonefile changes - I'm not sure whether
inline-signing can support a mixture of dynamic and manual
modifications. If you do need to support this mixed style, Tony Finch
has a script that will generate nsupdate-style change commands from the
difference between two manual zonefiles:
http://dotat.at/prog/nsdiff/
If you used this, you wouldn't enable inline-signing at all, since all
changes would be dynamic.
Graham
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
