mirror of
https://github.com/getnamingo/registry.git
synced 2025-05-14 08:37:00 +02:00
44 lines
1.6 KiB
Bash
44 lines
1.6 KiB
Bash
#!/bin/bash
|
|
ZONE="example.tld"
|
|
ROOT_SERVER="a.root-servers.net"
|
|
KEYDIR="/var/lib/bind" # Adjust if needed
|
|
LOGFILE="/var/log/namingo/dnssec-rollover.log"
|
|
|
|
echo "[$(date)] Checking IANA root zone for DS update..." | tee -a $LOGFILE
|
|
|
|
# Fetch DS records from IANA root zone
|
|
root_ds=$(dig +short DS $ZONE @$ROOT_SERVER | awk '{print $1, $2, $3, $4}')
|
|
if [[ -z "$root_ds" ]]; then
|
|
echo "[$(date)] ERROR: Unable to fetch DS records from IANA. Exiting." | tee -a $LOGFILE
|
|
exit 1
|
|
fi
|
|
|
|
# Fetch DS records from BIND (local KSKs)
|
|
local_ds=$(dnssec-dsfromkey -2 $KEYDIR/K${ZONE}*.key | awk '{print $1, $2, $3, $4}')
|
|
if [[ -z "$local_ds" ]]; then
|
|
echo "[$(date)] ERROR: Unable to fetch DS records from BIND. Exiting." | tee -a $LOGFILE
|
|
exit 1
|
|
fi
|
|
|
|
echo "[$(date)] DS records at IANA:" | tee -a $LOGFILE
|
|
echo "$root_ds" | tee -a $LOGFILE
|
|
echo "[$(date)] DS records in BIND:" | tee -a $LOGFILE
|
|
echo "$local_ds" | tee -a $LOGFILE
|
|
|
|
# Step 1: Check if IANA DS matches BIND DS (safe transition condition)
|
|
if [[ "$root_ds" == "$local_ds" ]]; then
|
|
echo "[$(date)] IANA has updated DS record. Safe to retire old KSK." | tee -a $LOGFILE
|
|
|
|
# Step 2: Identify and remove old KSKs from BIND
|
|
for key in $(ls $KEYDIR/K${ZONE}*.key); do
|
|
key_ds=$(dnssec-dsfromkey -2 $key | awk '{print $1, $2, $3, $4}')
|
|
|
|
if [[ ! "$root_ds" == *"$key_ds"* ]]; then
|
|
echo "[$(date)] Removing old KSK: $key" | tee -a $LOGFILE
|
|
rndc dnssec -clear key $ZONE
|
|
echo "[$(date)] Old KSK $key removed successfully." | tee -a $LOGFILE
|
|
fi
|
|
done
|
|
else
|
|
echo "[$(date)] DS record mismatch! Keeping old KSK active. Retrying later..." | tee -a $LOGFILE
|
|
fi
|