Tony's ramblings on Open Source Software, Life and Photography

dns

Creating SRV Records in PowerDNS

PowerDNS is a great little DNS server, especially if you want to use OpenLDAP for the backend. Unfortunately some of it's features are not well documented. That includes creating SRV records when using the "tree" structure of LDAP storage.

If you're using the tree structure for PowerDNS, you already have something like the following:

dc=yourdomain,dc=com,ou=powerdns,dc=ldapdomain

This shows in a tree view something like:

dc=ldapdomain
  ou=powerdns
    dc=com
      dc=yourdomain
        dc=server1
        dc=server2
...

If you want to use SRV records to let your DNS server tell apps where services are located, you must create the following branch structure:

dc=ldapdomain
  ou=powerdns
    dc=com
      dc=yourdomain
        dc=_tcp
          dc=_xmpp-client
          dc=_xmpp-server
        dc=server1
...

Notice you need a tree branch under "yourdomain" that is for the _tcp protocol. For udp services you'll need a tree branch called "_udp" obviously.

From there, you create the actual sRVRecords for the services such as _xmpp-client and _xmpp-server

Set the associatedDomain attribute to "_xmpp-client._tcp.yourdomain.com", etc., and set the sRVRecord to "[weight] [priority] [port] [target]".

An example LDIF would look like:

dn: dc=_tcp,dc=example,dc=com,ou=powerdns,dc=ldapdomain
  

Using OpenLDAP to configure Bind9 DNS Zones

I've recently started migrating much of our network services to OpenLDAP for the backend storage. I've switched completely from NIS authentication to LDAP, and even configured a Samba domain control for the few Windows logins that remain on our network.

For our internal DNS I run Bind9. Bind9 is notoriously hard for the average joe to configure, and to this point I've been using Webmin to manage my DNS entries. That works fine, but Ubuntu doesn't include Webmin packages, so I've been wanting to switch to something else. LDAP for the backend seemed like a perfect match.

At first I investigated using LDAP directly as the backend for DNS. It turns out this is highly experimental, and prevents Bind from doing any caching. The best solution is a package called ldap2dns. With ldap2dns it will automatically generate Bind9 zone files and restart Bind anytime your DNS entries in the LDAP server change.