Search

17.8. Configuring the bind-dyndb-ldap Plug-in

download PDF
The bind-dyndb-ldap system plug-in contains a DNS record cache for zones and a history of successful DNS resolutions. Maintaining the cache improves lookup performance in the Directory Server because it is not necessary to query the directory services every time there is a new DNS request.
When this plug-in is installed and IdM is configured to manage DNS, then a new configuration section is added to the plug-in configuration.

Example 17.11. Default dynamic-db Configuration

dynamic-db "ipa" {
        library "ldap.so";
        arg "uri ldapi://%2fvar%2frun%2fslapd-EXAMPLE.socket";
        arg "base cn=dns,dc=example,dc=com";
        arg "fake_mname server.example.com.";
        arg "auth_method sasl";
        arg "sasl_mech GSSAPI";
        arg "sasl_user DNS/server.example.com";
        arg "zone_refresh 0";
        arg "psearch yes";
        arg "serial_autoincrement 1";
};
This configuration uses implied default values for other plug-in behaviors, like how long it maintains the cache. The assumed, default configuration can be changed by adding arguments to the dynamic-db "ipa" entry.
arg "argument value";

Note

Both cache updates and new zone detection can be forced by reloading the name server:
# rndc reload
Table 17.4. Additional bind-dyndb-ldap Configuration Parameters
Parameter Description Default Value
cache_ttl Checks the DNS configuration in the Directory Server for new zones. 120 (seconds); this is defined in the bind-dyndb-ldap plug-in.
zone_refresh Checks frequency, in seconds, that the server checks the DNS configuration in the Directory Server for new zones. 0 (disabled)
psearch Enables persistent searches for the Directory Server so the BIND service immediately receives an update notification when a new DNS zone is added. yes

17.8.1. Changing the DNS Cache Setting

To improve DNS performance, it may be necessary to change the cache setting. By default, DNS records are kept in cache and considered valid for 120 seconds. This means that if a DNS record changes, it will not (necessarily) be propagated to the name server for up to 120 seconds. If the Directory Server has a high traffic volume or if records do not change frequently, then the cache time can be increased to improve performance by adding the cache_ttl parameter.
dynamic-db "ipa" { 
... 
    arg "cache_ttl 1800"; 
};
Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.