rndc: 'sign' failed: permission denied

[Phil Mayers]

On 07/07/2010 08:24 PM, L. Gabriel Somlo wrote:

> view "global" {
>
> 	zone "example.org" {
> 		type master;
> 		file "example.org.signed";
> 		allow-update {
> 			key foo;
> 		};
> };
>
> The problem is that, when I attempt
>
> 	rndc sign example.org
>
> from my server, I get
>
> 	rndc: 'sign' failed: permission denied
>
> The only thing logged by my server is
>
> 07-Jul-2010 15:11:29.614 info: received control channel command 'sign example.org'
>
> No indication as to what "permission" is denied, specifically.

You need "auto-dnssec maintain" in the zone statement