FreeIPA - Use rndc to control bind

By default, the freeipa-server installer will configure bind automatically into a working state. From time to time, it might be necessary to adjust some dynamic values such as tracing for debugging purposes. 

Bind ships with a convenient tool called 'rndc' to control bind dynamically. However, this is not enabled by default so there's some work to do.

In order to activate the remote control, you'll have to first create a rndc-key:

 [archy@ipa01 ~]$ sudo rndc-confgen -a -b 512 -c /etc/control-key -k control-key  
 [archy@ipa01 ~]$ sudo chmod 644 /etc/control-key  
 [archy@ipa01 ~]$ sudo restorecon -Rv /etc/control-key  

With the key created, create a control section in the named.conf to allow the key to control the named service. Open the named.conf file with an editor of your choice and add these lines:

 [archy@ipa01 ~]$ sudo vim /etc/named.conf  

 include "/etc/control-key";  
 controls {  
   inet 127.0.0.1 port 953 allow {  
     127.0.0.1; } keys { "control-key"; };  
 };  

With the config done, make sure the services are properly configured and restart the ipa services in order to ensure consistency:

 [archy@ipa01 ~]$ sudo named-checkconf; if [ $? -eq 0 ]; then echo 'all good'; else echo 'mistakes have been made'; fi  

If everything is configured appropriately, go ahead and restart the ipa services using ipactl:

 [archy@ipa01 ~]$ sudo ipactl restart  

When everything is restarted, you shoudl now be able to control the bind server using rndc commands, for example debugging can be increased using the 'rndc trace':

 [archy@ipa01 ~]$ rndc -s 127.0.0.1 -p 953 -k /etc/control-key trace 10  

To disable debugging, set the trace to 0 or use 'notrace'. Otherwise, this will fill up the log partition's space quite fast.

Feel free to comment and / or suggest a topic.