disable-dnssec

#!/bin/bash

# Copyright 2014-2015 Richard Russon (FlatCap)
# Licensed under the GPLv3

PATH="/var/named/bin:/usr/bin:/usr/sbin"
source log.sh

export TZ="UTC"

set -o errexit	# set -e
set -o nounset	# set -u

renice --priority 19 --pid $$ > /dev/null
ionice --class 3     --pid $$ > /dev/null

shopt -s nullglob

function finish()
{
	local RETVAL=$?
	[ $RETVAL = 0 ] || log_error "${0##*/} failed: $RETVAL"
}

trap finish EXIT

cd /var/named

[ $# = 0 ] && exit 2

log_info "Disable DNSSEC"

if [ $# = 1 -a "$1" = "all" ]; then
	set -- $DNSSEC_DOMAINS
fi

for ZONE in "$@"; do
	echo -e "\tZone: $ZONE"

	# edit named config
	#	disable inclusion of   signed domain
	#	enable  inclusion of unsigned domain
	sed -i \
		-e "s/^#\(\tfile\s\+\"$ZONE\.db\";\)/\1/" \
		-e "s/^\(\tfile\s\+\"$ZONE\.db.signed\";\)/#\1/" \
		named.conf

	# disable zone inclusion of tlsa records
	sed -i "s/^\$INCLUDE \"$ZONE\.tlsa\.inc\"$/;\0/" "$ZONE.db"
done

clean "$@"

ds-sync.pl
systemctl reload named
systemctl status named