ipa-dns-install(1)

📦 version 4.13.4, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

💖 ipa-dns-install — like, the manual page but make it make sense 🎀

okay bestie, welcome to the ipa-dns-install(1) glow-up, straight from the IPA Manual Pages. sit down, grab a strawberry drink 🍓, we're adding DNS to your IPA server and it's gonna be so cute.

✨ NAME ✨

ipa-dns-install — add DNS as a service to an IPA server. that's it, that's the girl. 💅

✨ SYNOPSIS ✨

ipa-dns-install [OPTION]...

✨ DESCRIPTION ✨

so what this does is: it configures an integrated DNS server on this IPA server, creates a DNS zone named after the IPA primary DNS domain, and then fills that zone in with all the service records IPA needs to actually deploy. 🦋

and lowkey important: in cases where the IPA server name does not belong to the primary DNS domain and isn't resolvable using DNS, it creates a DNS zone containing the IPA server name too. periodt.

IPA ships an integrated DNS server that can be used to simplify IPA deployment. if you decide to use it, IPA will automatically maintain SRV and other service records whenever you change your topology. no manual bookkeeping, we love that for us. ✨

the DNS component in IPA is optional though — you're fully allowed to manage all your DNS records by hand on some other third party DNS server. but heads up: IPA DNS is not a general-purpose DNS server. if you need advanced features like DNS views, do not deploy IPA DNS. it's giving "wrong tool for the job", ngl. 😭

also this command requires that an IPA server is already installed and configured. it's not building the whole thing from scratch, bestie, it's adding a service. 🫶

✨ OPTIONS ✨

  • -d, --debug — turn on debug logging for when you need the output to be, like, more verbose. 🔍
  • --ip-address=IP_ADDRESS — the IP address of the IPA server. if you don't give one, it gets determined based on the hostname of the server. you can use this option multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server). go off, multi-IP icon. 👑
  • --forwarder=FORWARDER — a forwarder is a DNS server where queries for a specific non-resolvable address can be directed. to define multiple forwarders, use multiple instances of --forwarder. 🌈
  • --no-forwarders — do not add any DNS forwarders. non-resolvable addresses get sent to the DNS root servers instead. no middleman, just vibes.
  • --auto-forwarders — add the DNS forwarders configured in /etc/resolv.conf to the list of forwarders used by IPA DNS. it literally reads the file for you. 💖
  • --forward-policy=first|only — the DNS forwarding policy for global forwarders specified using other options. defaults to first if no IP address belonging to a private or reserved ranges is detected on local interfaces (RFC 6303). defaults to only if a private IP address is detected. it's checking your interfaces, bestie, it's nosy like that. 👀
  • --reverse-zone=REVERSE_ZONE — the reverse DNS zone to use. this option can be used multiple times to specify multiple reverse zones. ✨
  • --no-reverse — do not create a new reverse DNS zone. if used on a replica and a reverse DNS zone already exists for the subnet, it will be used. reuse, reduce, recycle. 🧚
  • --auto-reverse — try to resolve reverse records and reverse zones for server IP addresses, and if neither is resolvable, it creates these reverse zones. 🪄
  • --no-dnssec-validation — disable DNSSEC validation on this server. 🙈
  • --dnssec-master — set up the server to be DNSSEC key master. main character energy fr. 🔥
  • --disable-dnssec-master — disable the DNSSEC master on this server.
  • --kasp-db=KASP_DB — copy OpenDNSSEC metadata from the specified kasp.db file. this will not create a new kasp.db file. it copies, it does not create. noted. 💀
  • --zonemgr — the e-mail address of the DNS zone manager. defaults to hostmaster@DOMAIN. 🎀
  • --allow-zone-overlap — allow creating a (reverse) zone even if the zone is already resolvable. using this option is discouraged, because it results in later problems with domain name resolution. it's giving "you can, but should you". 😭
  • -U, --unattended — an unattended installation that will never prompt for user input. perfect for scripts and for when you simply cannot be perceived. 💅
  • --dns-over-tls — configure DNS over TLS. 🔐
  • --dot-forwarder=IP_ADDRESS#HOSTNAME — add a DNS-over-TLS-enabled forwarder in the format of ip#hostname, e.g.: 1.2.3.4#dns.example.com. this option can be used multiple times. 🌸
  • --dns-over-tls-cert=FILE — certificate to use for DNS over TLS. if empty, a new certificate will be requested from IPA CA. 🎁
  • --dns-over-tls-key=FILE — key for the certificate specified in --dns-over-tls-key. (yes bestie, it says exactly that, we don't make the rules, we just report them. 🙈)
  • --dns-policy=relaxed|enforced — encrypted DNS policy. if enforced, DNS communications will only be allowed through the configured encrypted DNS methods. if relaxed, unencrypted DNS queries will be allowed. pick your fighter. 🥊

💀 DEPRECATED OPTIONS 💀

these are still here but they're like, so 2012. proceed with awareness, bestie.

  • -p DM_PASSWORD, --ds-password=DM_PASSWORD — the password to be used by the Directory Server for the Directory Manager user.

✨ EXIT STATUS ✨

  • 0 — if the installation was successful. slay. 🎉
  • 1 — if an error occurred. 😭
💡 reminder: this command needs an IPA server that's already installed and configured. it's an add-on, not a whole origin story.

and that's the whole page, bestie — every flag, every default, every warning, all of it, no notes. 💖

this little masterpiece comes from the IPA manual pages, dated Jun 28, 2012, and it's the one and only ipa-dns-install(1). go configure something iconic. 🦋✨💅

📦 where this page comes from