29.2. Installing an IdM server configured to use eDNS

Procedure

1. Add the dns-over-tls service to the system firewall to open port 853/TCP for DoT traffic:

   # firewall-cmd --add-service=dns-over-tls

2. Optional: To use a custom PEM-formatted certificate and key for DoT issued by an external certificate authority, create the files:

   $ openssl req \
     -newkey rsa:2048 \
     -nodes \
     -keyout /etc/pki/tls/certs/privkey.pem \
     -x509 \
     -days 36500 \
     -out /etc/pki/tls/certs/certificate.pem \
     -subj "/C=<country_code>/ST=<state>/L=<location>/O=<organization>/OU=<organizational_unit>/CN=<idm_server_fqdn>/emailAddress=<email>" && \
     chown named:named /etc/pki/tls/certs/privkey.pem /etc/pki/tls/certs/certificate.pem

3. Install the IdM server with integrated DNS:

   注記

   If you do not strictly require DoT, you can omit the --dns-policy option. The installer then uses the default relaxed policy.

   • To install the IdM server with externally issued keys and certificates, specify the certificate and key paths:

     # ipa-server-install --setup-dns --dns-over-tls --dot-forwarder "<server_ip>#<dns_server_hostname>" --dns-policy enforced --dns-over-tls-cert /etc/pki/tls/certs/certificate.pem --dns-over-tls-key /etc/pki/tls/certs/privkey.pem --no-dnssec-validation --auto-reverse --domain <domain_name> --realm <realm_name> --hostname <idm_server_fqdn> -p <admin_password> -a <admin_password> -U

   • To install the IdM server with the integrated IdM CA, run the following command:

     # ipa-server-install --setup-dns --dns-over-tls --dot-forwarder "<server_ip>#<dns_server_hostname>" --dns-policy enforced --no-dnssec-validation --auto-reverse --domain <domain_name> --realm <realm_name> --hostname <idm_server_fqdn> -p <admin_password> -a <admin_password> -U

Troubleshooting

1. Enable detailed logging for the unbound service:

   # unbound-control verbosity 3

2. Restart the unbound service to apply the updated configuration:

   # systemctl restart unbound

3. Monitor real-time logs of the unbound service:

   $ journalctl -u unbound -f