Page History

...

Adding / Removing zones
Updating an unsigned zone

Updating an unsigned zone

Tip

When you update the content of an unsigned zone you must manually tell the signer engine to re-read the unsigned zone file using the ods-signer command like this:

Code Block
ods-signer sign example.com

Updating the xml config files (including the KASP policy)

Info

When you make changes to conf.xml, kasp.xml or zonelist.xml you must run the

Code Block
ods-ksmutil update all

command (or the appropriate command listed below) in order for the changes to be propagated to the system database.

conf.xml

If you make changes to the enforcer or auditor section of the conf.xml file then you must run

Code Block
ods-ksmutil update conf

kasp.xml

When you make changes to a policy or add a new policy in kasp.xml you must update the changes to the database.

...

When making changes to the KASP policy the following should also be considered:

It is advised not to update policy details (in particular propagation times) while a rollover is in progress.
Changing the algorithm used in a policy is not supported in 1.3 or 1.4.
Certain policy changes e.g. changing 'Standby keys" from 'on' to 'off' may lead to orphaned keys.
After updating signature timers in the policy it may be helpful to issue the command:
Code Block
$ ods-signer clear <zone>; ods-signer sign <zone>
as it will speed up acclimatising timers for the signatures.

zonelist.xml

If you add zones directly into the zonelist (rather than using the ods-ksmutil zone add command) you must tell the enforcer to re-read the zone list by using the command:

Code Block
ods-ksmutil update zonelist

Logging

Details of logs produced by the system can be found on the Logging page.

All Versions

OpenDNSSEC Documentation v1.3

Child pages

Versions Compared

Old Version 3

New Version 4

Key