unbound: improve maintenance of trust anchor 4072/head
authorEric Luehrsen <ericluehrsen@hotmail.com>
Thu, 2 Mar 2017 05:28:35 +0000 (00:28 -0500)
committerEric Luehrsen <ericluehrsen@hotmail.com>
Thu, 2 Mar 2017 05:55:49 +0000 (00:55 -0500)
commit8e153c96845dd4763dbb1f49e16bb6c8d79d2f70
tree16461665722b3c301cc295d43396b6331ddcb84f
parentef0c0eeab0812256d459c4b8d331242f92c2dfe8
unbound: improve maintenance of trust anchor

Unbound UCI tries to protect embedded flash from excess
use. Unbound RFC5011 KSK tracking can rewrite root.key
every few minutes to an hour. It also writes and destroys
files in the same directory during the process.

Recommended UCI delays for copying busy work in /var/
back to /etc/ may be too conservative. These are all
changed from 28 to 9 days.

The RFC5011 KSK results were also destroyed by an
init.d restart, even if /var/ is mounted on persistent
storage like USB drive. /var/lib/unbound/root.key is
now preserved during this process, unless a newer key
is installed in /etc/ manually or package update.

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
net/unbound/Makefile
net/unbound/files/README.md
net/unbound/files/rootzone.sh
net/unbound/files/unbound.sh
net/unbound/files/unbound.uci