search

acmesh-official / acme.sh

A pure Unix shell script implementing ACME client protocol
https://acme.sh
GNU General Public License v3.0
38.58k stars 4.91k forks source link

dns_nsd does not update serial number of the zone #4137

Open AlexeyRudenko opened 2 years ago

AlexeyRudenko commented 2 years ago

Dear colleagues, Thank you for this excellent piece of software!! Unfortunately, it is not useful for NSD server, as it does not increment serial number in the zone file. As a result, the updated zone is not tranferred to the secondary server and the whole operation fails. I checked the file ~/.acme.sh/dnsapi/dns_nsd.sh It only adds/removes _acme-challenge TXT record to the zone file, and leaves its serial number intact. Thank you in advance!

sec commented 2 years ago

Hi, I was also checking the script and saw that it lacks serial increment support, but every zonefile can be diffrent, if you ask me, I would create custom reload script and put something like this inside (assuming your serial is only 10 digit text):

sed -i '' -E "s/[0-9]{10}/`date +%y%m%d%H%M`/g" /usr/local/etc/nsd/your.zonefile
nsd-control reload

and use this script as Nsd_Command

AlexeyRudenko commented 2 years ago

Thank you for the response! A nice patch! But not all zones contain exactly 10-digit zone number generated as %y%m%d%H%M. And my zone files in particular have verification codes of different services, which may contain 10 consecutive digits. I think it would be more reliable to analyze the SOA record and increase just the serial number. Unfortunately I am not an expert in Bash scripting and can not make this change by myself. Thanks again!