6 Zář
2017
6 Zář
'17
13:15
Hi Volker,
thank you for your question.
Your suggestion is almost correct, just a little correction:
knotc zone-freeze $ZONE
# wait for possibly still running events (check the logs manually or so...)
knotc zone-flush $ZONE # eventually with '-f' if zone synchronization is
disabled in config
$EDITOR $ZONEFILE # you SHALL increase the SOA serial if any changes
made in zonefile
knotc zone-reload $ZONE
knotc zone-thaw $ZONE
Reload before thaw - because after thaw, some events may start
processing, making the modified zonefile reload problematic.
BR,
Libor
Dne 5.9.2017 v 23:17 Volker Janzen napsal(a):
Hi,
I've setup knot to handle DNSSEC signing for a couple of zones. I like to update
zonefiles on disk with an editor and I want to clarify which steps need to be performed to
safely edit the zonefile on disk.
I currently try this:
knotc zone-freeze $ZONE
knotc zone-flush $ZONE
$EDITOR $ZONE
knotc zone-thaw $ZONE
knotc zone-reload $ZONE
As far as I can see knot increases the serial on reload and slaves will be notified.
Is this the correct command sequence?
Regards
Volker
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
6 Zář
6 Zář
13:32
New subject: Fwd: Re: Edit zonefile
On 09/06/2017 01:15 PM, libor.peltan(a)nic.cz wrote:
Hi Volker,
thank you for your question.
Your suggestion is almost correct, just a little correction:
knotc zone-freeze $ZONE
# wait for possibly still running events (check the logs manually or so...)
Or check
knotc zone-status $ZONE +freeze
for
[$ZONE] freeze: yes
knotc zone-flush $ZONE # eventually with '-f'
if zone synchronization is disabled in config
$EDITOR $ZONEFILE # you SHALL increase the SOA serial if any changes made in zonefile
knotc zone-reload $ZONE
knotc zone-thaw $ZONE
Reload before thaw - because after thaw, some events may start processing, making the
modified zonefile reload problematic.
BR,
Libor
Dne 5.9.2017 v 23:17 Volker Janzen napsal(a):
Hi,
I've setup knot to handle DNSSEC signing for a couple of zones. I like to update
zonefiles on disk with an editor and I want to clarify which steps need to be performed to
safely edit the zonefile on disk.
I currently try this:
knotc zone-freeze $ZONE
knotc zone-flush $ZONE
$EDITOR $ZONE
knotc zone-thaw $ZONE
knotc zone-reload $ZONE
As far as I can see knot increases the serial on reload and slaves will be notified.
Is this the correct command sequence?
Regards
Volker
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users 
14:17
New subject: Fwd: Re: Edit zonefile
Hi Daniel,
thanks for your reply.
Am 06.09.2017 um 13:32 schrieb Daniel Salzman
<daniel.salzman(a)nic.cz>cz>:
Does yes mean there is a concurrent freeze?
Regards
Volker
On 09/06/2017 01:15 PM, libor.peltan(a)nic.cz
wrote:
Hi Volker,
thank you for your question.
Your suggestion is almost correct, just a little correction:
knotc zone-freeze $ZONE
# wait for possibly still running events (check the logs manually or so...)
Or check
knotc zone-status $ZONE +freeze
for
[$ZONE] freeze: yes
14:22
Hi Libor,
thanks for your reply.
Am 06.09.2017 um 13:15 schrieb
"libor.peltan(a)nic.cz" <libor.peltan(a)nic.cz>cz>:
Hi Volker,
thank you for your question.
Your suggestion is almost correct, just a little correction:
knotc zone-freeze $ZONE
# wait for possibly still running events (check the logs manually or so...)
Would Daniels suggestion be enough, to check for another freeze? I want to have a shell
command to edit the knot zone file without further checks needed, beside what the script
does.
knotc zone-flush $ZONE # eventually with '-f'
if zone synchronization is disabled in config
Okay I added -f to be sure
$EDITOR $ZONEFILE # you SHALL increase the SOA serial
if any changes made in zonefile
Is there a safe way in this scenario to get the current SOA?
knotc zone-reload $ZONE
knotc zone-thaw $ZONE
Reload before thaw - because after thaw, some events may start processing, making the
modified zonefile reload problematic.
I see. I wasn't sure about the order of these two commands, which has been one
reason for me to just ask here on the list. :-)
Regards
Volker
14:31
New subject: Fwd: Re: Edit zonefile
Hi Volker,
yes, I forgot this useful option. The freeze item in zone-status has
four states: "no", "freezing" (= freeze in progress), "yes",
"thawing".
This is enough to safely check the status of freeze.
After the zone is freezed and zonefile flushed, you can get all the
current records safely directly from the zonefile, including SOA.
Anyway, you can still get all the records also by simply asking the
server e.g. by kdig ;)
Hope everything's clear now.
Please let us know later your experience with zone freeze, so we could
update the user manual as needed and handy.
BR,
Libor
Dne 6.9.2017 v 14:22 Volker Janzen napsal(a):
Hi Libor,
thanks for your reply.
Am 06.09.2017 um 13:15 schrieb "libor.peltan(a)nic.cz
<mailto:libor.peltan@nic.cz>" <libor.peltan(a)nic.cz
<mailto:libor.peltan@nic.cz>>:
Hi Volker,
thank you for your question.
Your suggestion is almost correct, just a little correction:
knotc zone-freeze $ZONE
# wait for possibly still running events (check the logs manually or
so...)
Would Daniels suggestion be enough, to check for another freeze? I
want to have a shell command to edit the knot zone file without
further checks needed, beside what the script does.
knotc zone-flush $ZONE # eventually with
'-f' if zone synchronization
is disabled in config
Okay I added -f to be sure
$EDITOR $ZONEFILE # you SHALL increase the SOA
serial if any changes
made in zonefile
Is there a safe way in this scenario to get the current SOA?
knotc zone-reload $ZONE
knotc zone-thaw $ZONE
Reload before thaw - because after thaw, some events may start
processing, making the modified zonefile reload problematic.
I see. I wasn't sure about the order of these two commands, which has
been one reason for me to just ask here on the list. :-)
Regards
Volker
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
2432
days inactive
2432
days old
4 comments
3 participants
participants (3)
-
Daniel Salzman -
libor.peltan＠nic.cz -
Volker Janzen