Subject: Re: [ISC-Bugs #37903] load TSIG keys at runtime 
In-Reply-To: Your message of "Tue, 25 Nov 2014 02:52:14 -0000." <rt-3.8.6-2430-1416883934-1401.37903-3-0@isc.org>
Date: Tue, 25 Nov 2014 14:15:27 +1100
References: <RT-Ticket-37903@isc.org> <20141125025212.GA459@isc.org> <rt-3.8.6-2430-1416883934-1401.37903-3-0@isc.org>
Content-Type: text/plain; charset="utf-8"
Message-ID: <20141125031528.03715243E555@rock.dv.isc.org>
To: bind-suggest@isc.org
From: Mark Andrews <marka@isc.org>
RT-Message-ID: <rt-3.8.6-2430-1416885334-869.37903-0-0@isc.org>
Content-Length: 835


We need to move the TSIG keys out of named.conf into a database
file.  Key-directory is not the place for these.  I really don't
want to have millions of files in the default key directory.

Using K* files for TSIG was a kludge.

The database key should be <downcased-name-wireformat> +
<downcased-algorithm-wireformat>.

The database data is the purge date (0 == don't purge) + shared
secret in binary form + original TKEY name if appropriate.

Any keys in named.conf just get added (marked not for purge).  TKEY
should write to this database.

External tools could add / remove w/o going through rndc.

We have a text based file format for TKEY/GSSAPI which should be
modified to use this.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org