<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Mon, Oct 21, 2013 at 9:37 AM, Petr Spacek <span dir="ltr"><<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 21.10.2013 17:58, Stephen Ingram wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
On Sun, Oct 20, 2013 at 11:44 PM, Petr Spacek <<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>> wrote:<br>
<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
On 18.10.2013 21:44, Stephen Ingram wrote:<br>
<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
I'm using IPA 3.0.x on RHEL 6.4 and trying to setup other zones in DNS. I<br>
notice that regardless of the TTL set in the SOA for the zone, the<br>
individual records default to 86400. I see there has been previous<br>
discussion on the list (<br>
</div><a href="https://www.redhat.com/**archives/freeipa-users/2012-**" target="_blank">https://www.redhat.com/**<u></u>archives/freeipa-users/2012-**</a><br>
November/msg00158.html<<a href="https://www.redhat.com/archives/freeipa-users/2012-November/msg00158.html" target="_blank">https:/<u></u>/www.redhat.com/archives/<u></u>freeipa-users/2012-November/<u></u>msg00158.html</a>><div class="im">
<br>
)<br>
saying that the 86400 value is hard-coded into bind-dyndb-ldap. It appears<br>
as though it might be rectified sometime in the 3.3.x series, however, I'm<br>
wondering if there is a workaround for now. Is there a way to just delete<br>
this value such that the individual records will default to the value in<br>
the SOA until a real fix comes along?<br>
<br>
</div></blockquote><div class="im">
<br>
For now, the only workaround is to set TTL explicitly for all affected DNS<br>
names. Sorry!<br>
<br>
$ ipa dnsrecord-mod --help | grep ttl<br>
--ttl=INT Time to live<br>
<br>
The most important thing is that SOA TTL is not related to default record<br>
TTL by definition.<br>
<br>
Some details are described here:<br>
</div><a href="https://www.redhat.com/**archives/freeipa-users/2012-**" target="_blank">https://www.redhat.com/**<u></u>archives/freeipa-users/2012-**</a><br>
November/msg00160.html<<a href="https://www.redhat.com/archives/freeipa-users/2012-November/msg00160.html" target="_blank">https:/<u></u>/www.redhat.com/archives/<u></u>freeipa-users/2012-November/<u></u>msg00160.html</a>><br>
</blockquote><div class="im">
<br>
<br>
Am I reading this correctly then that you have to set for each *record* vs<br>
</div></blockquote>
I really meant *name*. "ipa dnsrecord-mod" operates on whole DNS name. (It also means that all records under single *name* share the same TTL value.)</blockquote><div><br></div><div style>That's what I thought. I was referring to a name as a record.</div>
<div style> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
the *zone*. If so, this makes the DNS part of IPA almost unusable except to<br>
those willing to stick with the default 86400 or write a script to handle<br>
each record in the zone. I've been following the list for some time, but<br>
haven't heard much about usage of the DNS component. And, among the users I<br>
speak with no one uses the DNS component. Perhaps this is the reason why? I<br>
</blockquote></div>
Up to now, nobody have told us that 'DNS part of IPA almost unusable' without configuration option for default TTL, so it simply didn't get the priority. We have seen stroger demand for DNS views, for example :-)</blockquote>
<div><br></div><div style>Understood. Perhaps my use case is different than most. If I were using scripts, I don't think this would be much of an issue, however, with several UI users with varying levels of experience, it is difficult if you want to vary TTL per zone instead of per name. After reading the RFC referenced in the ticket I see now that the default TTL I was thinking was part of the SOA is actually a separate entity. And, thus, I now see why IPA needs to also make this distinction.</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
haven't looked at the code yet, but would this be that difficult to fix? I<br>
</blockquote></div>
If you are okay with statically configured TTL for all zones, then it is five-minute fix. (Simply change the current value and recompile or add a new parameter to /etc/named.conf.)<br></blockquote><div style>Could you please point me to the code where this static definition happens?</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
If you want to define default TTL per-zone in LDAP, then you have to define new attribute in LDAP schema, store the default TTL value in zone_register and push it to record parser as necessary.<br>
<br>
In <a href="https://fedorahosted.org/bind-dyndb-ldap/ticket/70#comment:7" target="_blank">https://fedorahosted.org/bind-<u></u>dyndb-ldap/ticket/70#comment:7</a> you can see that we are trying to cooperate with schema/OID space owner to find & standardize some solution.<br>
<br>
Any contribution is more than welcome! Join us in the ticket and we can discuss various propsals.</blockquote><div><br></div><div style>I see now why this is not a quick solution. I was unaware that the attribute to handle this default TTL didn't exist. It looks there are two ideas on the table (JHogarth and JCholasta) right now. But, from the ticket discussion, it looks like maybe the new attribute is being added instead and already in progress?</div>
<div style><br></div><div style>Steve</div></div></div></div>