[Freeipa-users] separating authoritative servers from recursive servers

[Brendan Kearney]

On 10/06/2015 07:42 AM, Petr Spacek wrote:
> On 6.10.2015 03:40, Brendan Kearney wrote:
>> i have two bind instances in somewhat of a multi-master server arrangement,
>> where they share the same ldap backend via bind-dyndb-ldap.  currently, they
>> are authoritative and recursive servers, and i want to change things up a
>> bit.  i want to move the recursive function to a third device.  for this, i
>> believe i need to set a forwarder for the two current servers.  i believe i
>> would do this by adding the idnsForwarders object (with value) on the OU that
>> is the idnsConfigObject.
>>
>> i am looking for a sanity check, to ensure that i am not overlooking something
>> important.  are there any steps i am missing?  i want the current two
>> instances to be authoritative for all my forward and reverse zones, and use
>> the forwarder for all recursion.  the forwarder instance is already running,
>> and is setup to answer queries from only the two current instances.  i think i
>> just need to point the current instances to the forwarder instance, and turn
>> off recursion on them.
> Hmm, I think that there is some confusion about terms we use.
>
> Pure authoritative server would give out answers only for zones it is
> authoritative for (i.e. zones defined in /etc/named.conf or LDAP) and refuse
> to answer all other queries. Is that what are you looking for?
>
> In contrast, a recursive server would answer query for any zone. If you really
> want to separate authoritative and recursive roles, then you should:
>
> (0. As always: Make sure that delegation for all your zones is correct.)
> 1. Set up recursive-only server. Add 'allow-recursion { IP_range; };' to
> named.conf.
> 2. Reconfigure all clients to use the recursive-only server and not to ask
> authoritative servers directly.
> 3. Reconfigure authoritative servers by adding allow-recursion { none; }; to
> named.conf.
>
> No changes in LDAP should be necessary.
>
> Does it answer your question?
>
i want to have separation of duties in my dns infrastructure.  the 
intention is to have clients point to the current instances of dns for 
all records.  behind the scenes, i want to have those current instances 
be authoritative for my internal zones, and for queries that they are 
not authoritative for, they reach out to the third server/instance for 
recursive queries.  the third server/instance for recursive queries 
should not be contacted by clients.  the end result is a hierarchy of 
roles for the dns instances.

from the bind docs:
The forwarding facility can be used to create a large site-wide cache on 
a few servers, reducing traffic over links to external name servers. It 
can also be used to allow queries by servers that do not have direct 
access to the Internet, but wish to look up exterior names anyway. 
Forwarding occurs only on those queries for which the server is not 
authoritative and does not have the answer in its cache.

I plan to remove external access for the two current dns instances and 
force them to use the instance set as the forwarder for all external or 
recursive lookups. it seems that the idnsForwarders attribute is where i 
start working on this.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20151006/8c9f7c8b/attachment.htm>