<html><head><base href="x-msg://63/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">On 11 Sep 2012, at 07:08, wfXLtg== wrote:<div><div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="line-height: 1.5; color: rgb(0, 0, 0); font-size: 10.5pt; margin-top: 10px; margin-right: 10px; margin-bottom: 10px; margin-left: 10px; "><div><div>Hi Matthijs,</div><div> </div><div>I'm now using Adapter File which is more stable than Adapter DNS.</div><div>The work flow is as follows:</div><div>1.generate zone files from db and saved in ./unsigned/</div><div>2.when all the zone files are ready, run ods-signer sign --all</div><div>3.monitor whether there are signed zones in ./signed/ and scp immediately signed</div><div>zone from ./signed to hidden master BIND , after transfer completeed using "rndc reload"</div></div></div></span></blockquote><div><br></div><div>Are you using the <NotifyCommand> mechanism for this? This is the best way to determine when the </div><div>signing is complete.</div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="line-height: 1.5; color: rgb(0, 0, 0); font-size: 10.5pt; margin-top: 10px; margin-right: 10px; margin-bottom: 10px; margin-left: 10px; "><div><div>to make BIND reload the newly signed zone file</div><div>4.test whether</div><div>4.do the above steps every 15 mins</div><div> </div><div>The problem is sometimes the zone files in the ./singed/ may be not signed by ods-signer</div><div>sign --all, it may be signed by automatic resign, so sometimes the RRs in the zones are</div><div>not the exact ones in db. So as you suggested, I have changed the resign value to a relatively</div><div>large number but I find that I have to changed refresh, validity/default,validity/denial, too,</div><div>so I can not set the resign period to 1Y for example, because refresh should be larger than resign</div><div>and validity/default and validity/denial should be larger than refresh. I think the validity is 30D</div><div>which is commonly used by registries, so can you recommend other values?</div><div> </div><div>And I knew that if a zone is not signed compeltely, ods-signerd will only create a <zone>.tmp file in</div><div>./signed/, but in my test I have found that a zone has been scped to the hidden master with less size</div><div>than its supposed size, and its file name is test not test.tmp, so my program is sure that it's signed completely</div><div>and transfer it to the destination. Is there a possibility that ods-signerd signs zone file not completely and</div><div>make <zone>.tmp to <zone>? If not, I can hardly understand why the signed file is more less than the unsigned one.</div></div></div></span></blockquote><div><br></div><div>Perhaps you can send us your xml files and log files offlist?</div><div><br></div><div>Thanks</div><div><br></div><div>Sara.</div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="line-height: 1.5; color: rgb(0, 0, 0); font-size: 10.5pt; margin-top: 10px; margin-right: 10px; margin-bottom: 10px; margin-left: 10px; "><div> </div><div>Best regards,</div><div>Stuart</div>_______________________________________________<br>Opendnssec-user mailing list<br><a href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a><br><a href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a><br></div></span></blockquote></div><br></div></body></html>