17.8. Configuring the bind-dyndb-ldap Plug-in
The
bind-dyndb-ldap system plug-in contains a DNS record cache for zones and a history of successful DNS resolutions. Maintaining the cache improves lookup performance in the Directory Server because it is not necessary to query the directory services every time there is a new DNS request.
When this plug-in is installed and IdM is configured to manage DNS, then a new configuration section is added to the plug-in configuration.
Example 17.11. Default dynamic-db Configuration
dynamic-db "ipa" {
library "ldap.so";
arg "uri ldapi://%2fvar%2frun%2fslapd-EXAMPLE.socket";
arg "base cn=dns,dc=example,dc=com";
arg "fake_mname server.example.com.";
arg "auth_method sasl";
arg "sasl_mech GSSAPI";
arg "sasl_user DNS/server.example.com";
arg "zone_refresh 0";
arg "psearch yes";
arg "serial_autoincrement 1";
};
This configuration uses implied default values for other plug-in behaviors, like how long it maintains the cache. The assumed, default configuration can be changed by adding arguments to the
dynamic-db "ipa" entry.
arg "argument value";
The additional parameters are listed in Table 17.4, “Additional bind-dyndb-ldap Configuration Parameters”.
Note
Both cache updates and new zone detection can be forced by reloading the name server:
# rndc reload
| Parameter | Description | Default Value |
|---|---|---|
| cache_ttl | Checks the DNS configuration in the Directory Server for new zones. | 120 (seconds); this is defined in the bind-dyndb-ldap plug-in. |
| zone_refresh | Checks frequency, in seconds, that the server checks the DNS configuration in the Directory Server for new zones. | 0 (disabled) |
| psearch | Enables persistent searches for the Directory Server so the BIND service immediately receives an update notification when a new DNS zone is added. | yes |
17.8.1. Changing the DNS Cache Setting
To improve DNS performance, it may be necessary to change the cache setting. By default, DNS records are kept in cache and considered valid for 120 seconds. This means that if a DNS record changes, it will not (necessarily) be propagated to the name server for up to 120 seconds. If the Directory Server has a high traffic volume or if records do not change frequently, then the cache time can be increased to improve performance by adding the
cache_ttl parameter.
dynamic-db "ipa" {
...
arg "cache_ttl 1800";
};17.8.2. Disabling Persistent Searches
The DNS service receives its information through the
bind-dyndb-ldap plug-in. The plug-in resolves only zones which were configured and enabled in the Directory Server when the name server started. When the name service restarts, the plug-in reloads its configuration and identifies any new zones or any new resource records.
However, the
bind-dyndb-ldap plug-in pulls zone and resource record information from the IdM LDAP directory, and it is possible to pull information from that directory apart from simply restarting the plug-in. The bind-dyndb-ldap plug-in searches for zone changes actively by keeping a persistent connection open to the Directory Server and immediately catching any changes.
Persistent searches provide immediate notification of changes and maintain a local cache of the configuration data.
Note
A persistent search catches updates both to zones and to zone resource records.
Because persistent searches leave an ongoing, open connection with the Directory Server, there can be some performance issues. Performance implications are covered in the Red Hat Directory Server Administrator's Guide.
Persistent searches are enabled by default but can be disabled in the
psearch argument:
dynamic-db "ipa" {
...
arg "psearch no";
};