Ensure Signing Keys are Scheduled to be Replaced Periodically

command -v dnssec-settime >/dev/null 2>&1 || exit 1
BH=''; for d in /var/named /etc/bind /var/cache/bind; do [ -d "$d" ] && BH="$BH $d"; done
[ -n "$BH" ] || { echo 'no BIND directory found'; exit 1; }
RUN=''; for d in /run/named /var/run/named; do [ -d "$d" ] && { RUN=$d; break; }; done
G='-group root'; U='-user root'; for a in named bind; do grep -q "^$a:" /etc/group 2>/dev/null && G="$G -o -group $a"; grep -q "^$a:" /etc/passwd 2>/dev/null && U="$U -o -user $a"; done
RT='^(/var/named(/chroot/var/named)?/(dynamic|slaves|data)|/var/named/chroot/(var/)?run/named|/var/named/chroot/var/log|/var/named/chroot/(var/)?tmp|/var/cache/bind|/run/named|/var/run/named)(/|$)'
keys=$(find $BH /etc/bind/keys -name 'K*.key' -type f 2>/dev/null | sort -u)
[ -n "$keys" ] || { echo compliant; exit 0; }
now=$(date +%s)
bad=$(for k in $keys; do
  if grep -q 'DNSKEY 256 3' "$k"; then lim=63072000; elif grep -q 'DNSKEY 257 3' "$k"; then lim=189216000; else continue; fi
  a=$(dnssec-settime -u -pA "$k" 2>/dev/null | awk '{print $NF; exit}')
  case "$a" in ''|*[!0-9]*) echo "$k: no activation date" ;; *) [ $((now - a)) -le $lim ] || echo "$k: activated $(( (now - a) / 86400 )) days ago" ;; esac
done)
[ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"

tmaegis scan --target bind --level 2