Chapter 99. Updating DNS records systematically when using external DNS

Procedure

• To generate a file with the DNS records for nsupdate, use the `ipa dns-update-system-records --dry-run command with the --out option. The --out option specifies the path of the file to generate:

  $ ipa dns-update-system-records --dry-run --out dns_records_file.nsupdate
   IPA DNS records:
     _kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 ipa.example.com.
     _kerberos-master._udp.example.com. 86400 IN SRV 0 100 88 ipa.example.com.
  [... output truncated ...]

  Copy to Clipboard Toggle word wrap

  The generated file contains the required DNS records in the format accepted by the nsupdate utility.

• The generated records rely on:

  • Automatic detection of the zone in which the records are to be updated.

  • Automatic detection of the zone’s authoritative server.

    If you are using an atypical DNS setup or if zone delegations are missing, nsupdate might not be able to find the right zone and server. In this case, add the following options to the beginning of the generated file:

  • server: specify the server name or port of the authoritative DNS server to which nsupdate sends the records.

  • zone: specify the name of the zone where nsupdate places the records.

    Example 99.1. Generated record

    $ cat dns_records_file.nsupdate
    zone example.com.
    server 192.0.2.1
    ; IPA DNS records
    update delete _kerberos-master._tcp.example.com. SRV
    update add _kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 ipa.example.com.
    [... output truncated ...]

    Copy to Clipboard Toggle word wrap

Prerequisites

• Your DNS server must be configured for TSIG.
• Both the DNS server and its client must have the shared key.

Procedure

• Run the nsupdate command and provide the shared secret using one of these options:

  • -k to provide the TSIG authentication key:

    $ nsupdate -k tsig_key.file dns_records_file.nsupdate

    Copy to Clipboard Toggle word wrap

  • -y to generate a signature from the name of the key and from the Base64-encoded shared secret:

    $ nsupdate -y algorithm:keyname:secret dns_records_file.nsupdate

    Copy to Clipboard Toggle word wrap

Prerequisites

• Your DNS server must be configured for GSS-TSIG.