[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Suitability of LDAP as DNS backend - PowerDNS LDAP backend moving to unmaintained status

On 2011.04.28 05.31, Nick Milas wrote:

It has been alleged (see ref. above) that "We don't think that LDAP
is a particularly good or interesting place to store DNS data.


this doesn't make much sense to me.  from the perspective of traditional [e.g. non dnssec], it's simply another place in which data can be stored.  from a dnssec perspective, you could perhaps argue there is additional complexity since rrsets and zones now need to be signed, but really, this is still fundamentally no different than singing the data stored via some other means.  the data must be parsed, processed, and written, in some way.  just as there are already mechanisms in place for doing this with traditional text files, the very same could be done for data stored in ldap.  whatever needs to be done must as some point be done for the first time.  the existence of "natural" methods like writing to a text file certainly don't preclude other methods from having value simply because they've not yet been given a formal implementation.

additionally, there is software like phreebird [a dnssec proxy], which allow you to retain all of your dns data in its traditional form, and still provide signed zones.  lastly, iirc, the notion of a dns related overlay and/or backend has come up here on occasion.  not only would this obviously be a natural fit for openldap, the concepts involved in dnssec could be integrated quite nicely.


Additionally, LDAP/database backend projects for BIND9 (SDB and DLZ)
do not seem very well maintained either. In any case we prefer
PowerDNS approach where backend implementation is cleaner and
direct.


with respect to bind, if i were you, i'd keep up to date on the development of bind 10.  while it's not my place to speak for the developers, i think you're likely to find quite a bit of attention given to abstraction between the server and its backend  ;)

-ben