No edit summary |
No edit summary |
||
| Line 6: | Line 6: | ||
[[User:pwouters]] dnsmasq can interfere with the system easilly - currently I experience problems with dnsmasq stealing port 53 when used for KVM as dhcp server. There should definitely be a conversation with the NM people to see how to make things work. Moving to a non-DNSSEC caching local resolver seems to me to be a non-option at this time. Chaining might be an option. Also, unbound has various options to deal with changing ips and dhcp obtained caches (even when they include a mix of dnssec-capable and dnssec-incapable dns servers) | [[User:pwouters]] dnsmasq can interfere with the system easilly - currently I experience problems with dnsmasq stealing port 53 when used for KVM as dhcp server. There should definitely be a conversation with the NM people to see how to make things work. Moving to a non-DNSSEC caching local resolver seems to me to be a non-option at this time. Chaining might be an option. Also, unbound has various options to deal with changing ips and dhcp obtained caches (even when they include a mix of dnssec-capable and dnssec-incapable dns servers) | ||
- [[User:dcbw]] | |||
I'd prefer to use dnsmasq if at all possible, by potentially fixing whatever issues it has with DNSSEC. While I know BIND can do DNSSEC out of the box it's quite heavy-weight for what we really want it for. dnsmasq is already deployed pretty much everywhere since it's capable and tiny. | |||
That said, I'm adding caching nameserver support to NetworkManager right now on the [http://cgit.freedesktop.org/NetworkManager/NetworkManager/log/?h=cachingdns cachingdns branch]. dnsmasq support is already written, and I'm working on BIND support right now. I'd prefer if we could set the Fedora NetworkManager to use dnsmasq by default, and if users really want BIND for some reason they could enable that through /etc/NetworkManager/NetworkManager.conf. | |||
I'm also highly allergic to Yet Another Checkbox. If we can avoid adding more UI for this (by turning DNSSEC on by default) then we should do so. However, we first need to determine the failure cases and just how bad they'd be before I'd entertain the idea of adding a UI on/off switch for it. | |||
Second, if somebody could post a config file in which bind has been configured as a fowarding, caching-only nameserver with DNSSEC enabled that would greatly help me. | |||
Revision as of 22:34, 15 September 2010
- Why is this a checkbox to enable, vs a checkbox to disable? User:notting
User:pwouters If this feature is moved to f15, I suggest a checkbox to disable as well. perhaps f14 can see an update with an enable box?
- I've heard that NM is planning on moving to dnsmasq as a local resolver in the future. This would conflict with that. User:notting
User:pwouters dnsmasq can interfere with the system easilly - currently I experience problems with dnsmasq stealing port 53 when used for KVM as dhcp server. There should definitely be a conversation with the NM people to see how to make things work. Moving to a non-DNSSEC caching local resolver seems to me to be a non-option at this time. Chaining might be an option. Also, unbound has various options to deal with changing ips and dhcp obtained caches (even when they include a mix of dnssec-capable and dnssec-incapable dns servers)
I'd prefer to use dnsmasq if at all possible, by potentially fixing whatever issues it has with DNSSEC. While I know BIND can do DNSSEC out of the box it's quite heavy-weight for what we really want it for. dnsmasq is already deployed pretty much everywhere since it's capable and tiny.
That said, I'm adding caching nameserver support to NetworkManager right now on the cachingdns branch. dnsmasq support is already written, and I'm working on BIND support right now. I'd prefer if we could set the Fedora NetworkManager to use dnsmasq by default, and if users really want BIND for some reason they could enable that through /etc/NetworkManager/NetworkManager.conf.
I'm also highly allergic to Yet Another Checkbox. If we can avoid adding more UI for this (by turning DNSSEC on by default) then we should do so. However, we first need to determine the failure cases and just how bad they'd be before I'd entertain the idea of adding a UI on/off switch for it.
Second, if somebody could post a config file in which bind has been configured as a fowarding, caching-only nameserver with DNSSEC enabled that would greatly help me.