<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/06/2015 07:42 AM, Petr Spacek
wrote:<br>
</div>
<blockquote cite="mid:5613B3B5.9040200@redhat.com" type="cite">
<pre wrap="">On 6.10.2015 03:40, Brendan Kearney wrote:
</pre>
<blockquote type="cite">
<pre wrap="">i have two bind instances in somewhat of a multi-master server arrangement,
where they share the same ldap backend via bind-dyndb-ldap. currently, they
are authoritative and recursive servers, and i want to change things up a
bit. i want to move the recursive function to a third device. for this, i
believe i need to set a forwarder for the two current servers. i believe i
would do this by adding the idnsForwarders object (with value) on the OU that
is the idnsConfigObject.
i am looking for a sanity check, to ensure that i am not overlooking something
important. are there any steps i am missing? i want the current two
instances to be authoritative for all my forward and reverse zones, and use
the forwarder for all recursion. the forwarder instance is already running,
and is setup to answer queries from only the two current instances. i think i
just need to point the current instances to the forwarder instance, and turn
off recursion on them.
</pre>
</blockquote>
<pre wrap="">
Hmm, I think that there is some confusion about terms we use.
Pure authoritative server would give out answers only for zones it is
authoritative for (i.e. zones defined in /etc/named.conf or LDAP) and refuse
to answer all other queries. Is that what are you looking for?
In contrast, a recursive server would answer query for any zone. If you really
want to separate authoritative and recursive roles, then you should:
(0. As always: Make sure that delegation for all your zones is correct.)
1. Set up recursive-only server. Add 'allow-recursion { IP_range; };' to
named.conf.
2. Reconfigure all clients to use the recursive-only server and not to ask
authoritative servers directly.
3. Reconfigure authoritative servers by adding allow-recursion { none; }; to
named.conf.
No changes in LDAP should be necessary.
Does it answer your question?
</pre>
</blockquote>
i want to have separation of duties in my dns infrastructure. the
intention is to have clients point to the current instances of dns
for all records. behind the scenes, i want to have those current
instances be authoritative for my internal zones, and for queries
that they are not authoritative for, they reach out to the third
server/instance for recursive queries. the third server/instance
for recursive queries should not be contacted by clients. the end
result is a hierarchy of roles for the dns instances.<br>
<br>
from the bind docs:<br>
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external name
servers. It can also be used to allow queries by servers that do not
have direct access to the Internet, but wish to look up exterior
names anyway. Forwarding occurs only on those queries for which the
server is not authoritative and does not have the answer in its
cache.
<div class="variablelist">
<dl>
<dt><span class="term"><span><span class="command">I plan to
remove external access for the two current dns instances
and force them to use the instance set as the forwarder
</span></span></span>for all external or recursive lookups.
it seems that the idnsForwarders attribute is where i start
working on this.<br>
</dt>
</dl>
</div>
</body>
</html>