DNSSEC ZSK Rollover

[ShaneMcC]

ZSKs should rollover automatically.

[ShaneMcC]

https://www.eriklundblad.com/log/post/automatic-zone-signing-key-rollover-in-bind/

[ShaneMcC]

In case the page referenced above vanishes:

#!/bin/sh

KEYGEN="/usr/sbin/dnssec-keygen"
SETTIME="/usr/sbin/dnssec-settime"
DNSSEC_KEYS="/var/named/chroot/etc/pki/dnssec-keys"
ZONEFILES="/var/named/chroot/var/named/master"

DOMAIN="$1"

if [ $# -eq 0 ]
then
	echo "Syntax: ./$(basename $0) mydomain.tld"
	exit 1
fi

ZONEFILE="${ZONEFILES}/${DOMAIN}.zone"

if [ ! -f $ZONEFILE ]
then
    echo "File ${DOMAIN}.zone not found!"
    exit 1
fi

OLDKEYS="$(grep -l "zone-signing key" $DNSSEC_KEYS/K$DOMAIN.*)"

if [ -z "$OLDKEYS" ]
then
   echo "Unable to find an existing zone-signing key, exiting."
   exit 1
fi

ACTIVEKEY="$(grep -L "Inactive" $OLDKEYS)"

if [ -z "$ACTIVEKEY" ]
then
   echo "Unable to find an active zone-signing key, exiting."
   exit 1
fi

if (( $(grep -c . <<<"$ACTIVEKEY") > 1 ))
then
   echo "Found multiple active zone-signing keys, exiting."
   exit 1
fi

echo "Found key: $ACTIVEKEY"

$SETTIME -I +172800 -D +345600 $ACTIVEKEY

KEYNAME="$($KEYGEN -K $DNSSEC_KEYS -S $ACTIVEKEY -i 172800)"

echo "Generated key: ${KEYNAME}"

echo "Setting owner on generated key"
chown "named:named" "$DNSSEC_KEYS/$KEYNAME.key"
chown "named:named" "$DNSSEC_KEYS/$KEYNAME.private"