Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently waste a lot of time making dns changes for my organization. DDNS of course helps for workstations, but we still have a few thousand unique servers with still more applications needing cname records that DHCP/DDNS alone will not support, so someone needs to make updates, but I'd like to see sysadmins make their own dns updates for their machines.

I'm currently working on extending our asset database to support this functionality, but I hold out hope that there are COTS solutions available.

share|improve this question
add comment

2 Answers 2

You didn't mention what DNS server is in use and you didn't mention whether or not this was in a Windows AD domain, but if this is in relation to Windows DNS, I've used the following to grant limited access to our DNS zones:

http://www.quest.com/activeroles-server/dnsm.aspx

share|improve this answer
    
I was trying to keep this as general as possible in order to not drive anyone away. I could change our dns infrastructure if I had to. Our organization does use Active Directory heavily, and this article is speaking my language. If it geniunely allows delegation to AD groups and proper self-provisioning, I may have an answer. Much thanks. –  Jaredk Dec 8 '12 at 17:47
    
I use it to allow a group of junior admins to manage CNAME records in a subdomain of our AD DNS zone, so it sounds like it's up your alley. –  joeqwerty Dec 8 '12 at 18:19
add comment

In past organizations, we've kept our zone files in version control, and allowed the sysadmin team(s) to edit, commit, and push their changes directly to the central git repo and post-commit hooks took care of sanity checking the syntax of the new commit, deploying to the production name servers, and kicking bind to pull in the new configs.

In our case, anyone could have edited any dns record, but fortunately we had enough trust among the staff that people wouldn't touch records that weren't theirs.

If you need more separation than that, you can keep different zones in different repos, with different permissions.

share|improve this answer
1  
Thanks. I wish I could trust my System administrators that much. –  Jaredk Dec 8 '12 at 17:55
3  
If you can't trust your System administrators that much, what are they doing administering your systems. –  BillThor Dec 9 '12 at 1:10
    
@BillThor - My thoughts exactly. –  EEAA Dec 9 '12 at 1:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.