public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split named custom config to allow changes in options stanza

Browse Source 
Upgrade path to add additional include to named.conf is not handled.

Remove bindkeys-file directive from named config
The ISC DVL service was shut down (https://www.isc.org/bind-keys/).
BIND versions since April 2017 (i.e. 9.9.10, 9.10.5, 9.11.1 and later)
include a hard-coded copy of the root KSK which gets updates automatically
according to RFC 5011.

Move dnssec-enable directive to custom named config

Move comment named config being managed by FreeIPA to the top

Move settings which could be changed by administrators to
ipa-options-ext.conf. Settings defined there are sole responsibility of the
administrator. We do not check if they might collide with our settings in
named.conf.

Fixes: https://pagure.io/freeipa/issue/8287
Co-authored-by: Peter Keresztes Schmidt <carbenium@outlook.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Peter Keresztes Schmidt authored and Alexander Bokovoy committed 2020-06-08 15:53:40 +03:00
1 parent 88d1dcc52a
commit a5cbdb57e5
10 files changed
+61 -30
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

freeipa.spec.in
+2
View File
@@ -1221,6 +1221,7 @@ fi
%{_usr}/share/ipa/*.uldif
%{_usr}/share/ipa/*.template
%{_usr}/share/ipa/bind.ipa-ext.conf
%{_usr}/share/ipa/bind.ipa-options-ext.conf.template
%dir %{_usr}/share/ipa/advise
%dir %{_usr}/share/ipa/advise/legacy
%{_usr}/share/ipa/advise/legacy/*.template
@@ -1266,6 +1267,7 @@ fi
%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf
%ghost %attr(0644,root,root) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
%ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-ext.conf
%ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-options-ext.conf
%ghost %attr(0644,root,root) %{_usr}/share/ipa/html/krb.con
%ghost %attr(0644,root,root) %{_usr}/share/ipa/html/krb5.ini
%ghost %attr(0644,root,root) %{_usr}/share/ipa/html/krbrealm.con
install/share/Makefile.am
+1
View File
@@ -46,6 +46,7 @@ dist_app_DATA = \
kerberos.ldif \
indices.ldif \
bind.ipa-ext.conf \
bind.ipa-options-ext.conf.template \
bind.named.conf.template \
certmap.conf.template \
kdc.conf.template \
install/share/bind.ipa-ext.conf
-4
View File
@@ -7,9 +7,5 @@
// 234.234.234.0/24;
// 2001::co:ffee:babe:1/48;
// };
// options {
// allow-recursion {trusted_network;};
// allow-query-cache {trusted_network;};
// };
//
// This file will NOT be overridden during updates!
install/share/bind.ipa-options-ext.conf.template
+13
View File
@@ -0,0 +1,13 @@
// Custom managed file.
// Here you can set your own options included inside the options stanza:
//
// allow-recursion { trusted_network; };
// allow-query-cache { trusted_network; };
//
// This file will NOT be overridden during updates!
// turns on IPv6 for port 53, IPv4 is on by default for all ifaces
listen-on-v6 { any; };
/* dnssec-enable is obsolete and 'yes' by default */
dnssec-validation $NAMED_DNSSEC_VALIDATION;
install/share/bind.named.conf.template
+6 -10
View File
@@ -1,7 +1,8 @@
options {
// turns on IPv6 for port 53, IPv4 is on by default for all ifaces
listen-on-v6 {any;};
/* WARNING: This part of the config file is IPA-managed.
* Modifications may break IPA setup or upgrades.
*/
options {
// Put files that named is allowed to write in the data/ directory:
directory "$NAMED_VAR_DIR"; // the default
dump-file "${NAMED_DATA_DIR}cache_dump.db";
@@ -12,15 +13,13 @@ options {
// "allow-recursion" are set to "localnets; localhost;".
// If either "allow-query-cache" or "allow-recursion" is set,
// the other would be set the same value.
// Please refer to $CUSTOM_CONFIG
// Please refer to $CUSTOM_OPTIONS_CONFIG
// for more informations
include "$CUSTOM_OPTIONS_CONFIG";
tkey-gssapi-keytab "$NAMED_KEYTAB";
pid-file "$NAMED_PID";
/* dnssec is enabled by default */
dnssec-validation yes;
managed-keys-directory "$MANAGED_KEYS_DIR";
/* crypto policy snippet on platforms with system-wide policy. */
@@ -50,9 +49,6 @@ include "$ROOT_KEY";
/* custom configuration snippet */
include "$CUSTOM_CONFIG";
/* WARNING: This part of the config file is IPA-managed.
* Modifications may break IPA setup or upgrades.
*/
dyndb "ipa" "$BIND_LDAP_SO" {
uri "ldapi://%2fvar%2frun%2fslapd-$SERVER_ID.socket";
base "cn=dns, $SUFFIX";
ipaplatform/base/paths.py
+3
View File
@@ -80,7 +80,10 @@ class BasePathNamespace:
LIBNSS_LDAP_CONF = "/etc/libnss-ldap.conf"
NAMED_CONF = "/etc/named.conf"
NAMED_CUSTOM_CONFIG = "/etc/named/ipa-ext.conf"
NAMED_CUSTOM_OPTIONS_CONFIG = "/etc/named/ipa-options-ext.conf"
NAMED_CUSTOM_CFG_SRC = '/usr/share/ipa/bind.ipa-ext.conf'
NAMED_CUSTOM_OPTIONS_CFG_SRC = \
'/usr/share/ipa/bind.ipa-options-ext.conf.template'
NAMED_VAR_DIR = "/var/named"
NAMED_KEYTAB = "/etc/named.keytab"
NAMED_RFC1912_ZONES = "/etc/named.rfc1912.zones"
ipaplatform/debian/paths.py
+1
View File
@@ -34,6 +34,7 @@ class DebianPathNamespace(BasePathNamespace):
HTTPD_PASSWORD_CONF = "/etc/apache2/password.conf"
NAMED_CONF = "/etc/bind/named.conf"
NAMED_CUSTOM_CONFIG = "/etc/bind/ipa-ext.conf"
NAMED_CUSTOM_OPTIONS_CONFIG = "/etc/bind/ipa-options-ext.conf"
NAMED_VAR_DIR = "/var/cache/bind"
NAMED_KEYTAB = "/etc/bind/named.keytab"
NAMED_RFC1912_ZONES = "/etc/bind/named.conf.default-zones"
ipaserver/install/bindinstance.py
+22 -13
View File
@@ -295,7 +295,7 @@ def find_reverse_zone(ip_address, api=api):
return None
def named_add_ext_conf_file(src, dest, t_params={}):
def named_add_ext_conf_file(src, dest, t_params=None):
"""
Ensure included file is present, but don't override it.
@@ -303,6 +303,9 @@ def named_add_ext_conf_file(src, dest, t_params={}):
:param dest: String. Absolute path to destination
:param t_params: Dict. Parameters for source template
"""
if t_params is None:
t_params = {}
if not os.path.exists(dest):
ipa_ext_txt = ipautil.template_file(src, t_params)
gid = pwd.getpwnam(constants.NAMED_USER).pw_gid
@@ -837,6 +840,7 @@ class BindInstance(service.Service):
BIND_LDAP_SO=paths.BIND_LDAP_SO,
INCLUDE_CRYPTO_POLICY=crypto_policy,
CUSTOM_CONFIG=paths.NAMED_CUSTOM_CONFIG,
CUSTOM_OPTIONS_CONFIG=paths.NAMED_CUSTOM_OPTIONS_CONFIG,
NAMED_DATA_DIR=constants.NAMED_DATA_DIR,
NAMED_ZONE_COMMENT=constants.NAMED_ZONE_COMMENT,
)
@@ -988,20 +992,24 @@ class BindInstance(service.Service):
named_txt = ipautil.template_file(
os.path.join(paths.USR_SHARE_IPA_DIR, "bind.named.conf.template"),
self.sub_dict)
named_fd = open(paths.NAMED_CONF, 'w')
named_fd.seek(0)
named_fd.truncate(0)
named_fd.write(named_txt)
named_fd.close()
named_add_ext_conf_file(paths.NAMED_CUSTOM_CFG_SRC,
paths.NAMED_CUSTOM_CONFIG)
gid = pwd.getpwnam(constants.NAMED_USER).pw_gid
with open(paths.NAMED_CONF, 'w') as named_conf:
os.fchmod(named_conf.fileno(), 0o640)
os.fchown(named_conf.fileno(), 0, gid)
named_conf.write(named_txt)
if self.no_dnssec_validation:
# disable validation
named_conf_set_directive("dnssec-validation", "no",
section=NAMED_SECTION_OPTIONS,
str_val=False)
named_add_ext_conf_file(
paths.NAMED_CUSTOM_CFG_SRC,
paths.NAMED_CUSTOM_CONFIG
)
dnssec_validation = 'no' if self.no_dnssec_validation else 'yes'
named_add_ext_conf_file(
paths.NAMED_CUSTOM_OPTIONS_CFG_SRC,
paths.NAMED_CUSTOM_OPTIONS_CONFIG,
{'NAMED_DNSSEC_VALIDATION': dnssec_validation}
)
# prevent repeated upgrade on new installs
sysupgrade.set_upgrade_state(
@@ -1260,5 +1268,6 @@ class BindInstance(service.Service):
self.named_regular.start()
ipautil.remove_file(paths.NAMED_CUSTOM_CONFIG)
ipautil.remove_file(paths.NAMED_CUSTOM_OPTIONS_CONFIG)
ipautil.remove_keytab(self.keytab)
ipautil.remove_ccache(run_as=self.service_user)
ipaserver/install/ipa_backup.py
+1
View File
@@ -125,6 +125,7 @@ class Backup(admintool.AdminTool):
files = (
paths.NAMED_CONF,
paths.NAMED_CUSTOM_CONFIG,
paths.NAMED_CUSTOM_OPTIONS_CONFIG,
paths.NAMED_KEYTAB,
paths.RESOLV_CONF,
paths.SYSCONFIG_PKI_TOMCAT,
ipaserver/install/server/upgrade.py
+12 -3
View File
@@ -594,9 +594,18 @@ def named_add_ipa_ext_conf_file():
logger.info('DNS is not configured.')
return False
return bindinstance.named_add_ext_conf_file(
paths.NAMED_CUSTOM_CFG_SRC,
paths.NAMED_CUSTOM_CONFIG)
tasks = [
bindinstance.named_add_ext_conf_file(
paths.NAMED_CUSTOM_CFG_SRC,
paths.NAMED_CUSTOM_CONFIG
),
bindinstance.named_add_ext_conf_file(
paths.NAMED_CUSTOM_OPTIONS_CFG_SRC,
paths.NAMED_CUSTOM_OPTIONS_CONFIG
)
]
return any(tasks)
def named_set_minimum_connections():