diff --git a/freeipa.spec.in b/freeipa.spec.in index 0bd64f208..38237d0ec 100755 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -1221,6 +1221,7 @@ fi %{_usr}/share/ipa/*.uldif %{_usr}/share/ipa/*.template %{_usr}/share/ipa/bind.ipa-ext.conf +%{_usr}/share/ipa/bind.ipa-options-ext.conf.template %dir %{_usr}/share/ipa/advise %dir %{_usr}/share/ipa/advise/legacy %{_usr}/share/ipa/advise/legacy/*.template @@ -1266,6 +1267,7 @@ fi %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf %ghost %attr(0644,root,root) %config(noreplace) %{_usr}/share/ipa/html/ca.crt %ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-ext.conf +%ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-options-ext.conf %ghost %attr(0644,root,root) %{_usr}/share/ipa/html/krb.con %ghost %attr(0644,root,root) %{_usr}/share/ipa/html/krb5.ini %ghost %attr(0644,root,root) %{_usr}/share/ipa/html/krbrealm.con diff --git a/install/share/Makefile.am b/install/share/Makefile.am index 2c1c5a4de..0fc173e31 100644 --- a/install/share/Makefile.am +++ b/install/share/Makefile.am @@ -46,6 +46,7 @@ dist_app_DATA = \ kerberos.ldif \ indices.ldif \ bind.ipa-ext.conf \ + bind.ipa-options-ext.conf.template \ bind.named.conf.template \ certmap.conf.template \ kdc.conf.template \ diff --git a/install/share/bind.ipa-ext.conf b/install/share/bind.ipa-ext.conf index 24713679d..91136def9 100644 --- a/install/share/bind.ipa-ext.conf +++ b/install/share/bind.ipa-ext.conf @@ -7,9 +7,5 @@ // 234.234.234.0/24; // 2001::co:ffee:babe:1/48; // }; -// options { -// allow-recursion {trusted_network;}; -// allow-query-cache {trusted_network;}; -// }; // // This file will NOT be overridden during updates! diff --git a/install/share/bind.ipa-options-ext.conf.template b/install/share/bind.ipa-options-ext.conf.template new file mode 100644 index 000000000..7872c8bad --- /dev/null +++ b/install/share/bind.ipa-options-ext.conf.template @@ -0,0 +1,13 @@ +// Custom managed file. +// Here you can set your own options included inside the options stanza: +// +// allow-recursion { trusted_network; }; +// allow-query-cache { trusted_network; }; +// +// This file will NOT be overridden during updates! + +// turns on IPv6 for port 53, IPv4 is on by default for all ifaces +listen-on-v6 { any; }; + +/* dnssec-enable is obsolete and 'yes' by default */ +dnssec-validation $NAMED_DNSSEC_VALIDATION; diff --git a/install/share/bind.named.conf.template b/install/share/bind.named.conf.template index 6fd78579b..4d08b1d36 100644 --- a/install/share/bind.named.conf.template +++ b/install/share/bind.named.conf.template @@ -1,7 +1,8 @@ -options { - // turns on IPv6 for port 53, IPv4 is on by default for all ifaces - listen-on-v6 {any;}; +/* WARNING: This part of the config file is IPA-managed. + * Modifications may break IPA setup or upgrades. + */ +options { // Put files that named is allowed to write in the data/ directory: directory "$NAMED_VAR_DIR"; // the default dump-file "${NAMED_DATA_DIR}cache_dump.db"; @@ -12,15 +13,13 @@ options { // "allow-recursion" are set to "localnets; localhost;". // If either "allow-query-cache" or "allow-recursion" is set, // the other would be set the same value. - // Please refer to $CUSTOM_CONFIG + // Please refer to $CUSTOM_OPTIONS_CONFIG // for more informations + include "$CUSTOM_OPTIONS_CONFIG"; tkey-gssapi-keytab "$NAMED_KEYTAB"; pid-file "$NAMED_PID"; - /* dnssec is enabled by default */ - dnssec-validation yes; - managed-keys-directory "$MANAGED_KEYS_DIR"; /* crypto policy snippet on platforms with system-wide policy. */ @@ -50,9 +49,6 @@ include "$ROOT_KEY"; /* custom configuration snippet */ include "$CUSTOM_CONFIG"; -/* WARNING: This part of the config file is IPA-managed. - * Modifications may break IPA setup or upgrades. - */ dyndb "ipa" "$BIND_LDAP_SO" { uri "ldapi://%2fvar%2frun%2fslapd-$SERVER_ID.socket"; base "cn=dns, $SUFFIX"; diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index 9d5f03271..6723c1c53 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -80,7 +80,10 @@ class BasePathNamespace: LIBNSS_LDAP_CONF = "/etc/libnss-ldap.conf" NAMED_CONF = "/etc/named.conf" NAMED_CUSTOM_CONFIG = "/etc/named/ipa-ext.conf" + NAMED_CUSTOM_OPTIONS_CONFIG = "/etc/named/ipa-options-ext.conf" NAMED_CUSTOM_CFG_SRC = '/usr/share/ipa/bind.ipa-ext.conf' + NAMED_CUSTOM_OPTIONS_CFG_SRC = \ + '/usr/share/ipa/bind.ipa-options-ext.conf.template' NAMED_VAR_DIR = "/var/named" NAMED_KEYTAB = "/etc/named.keytab" NAMED_RFC1912_ZONES = "/etc/named.rfc1912.zones" diff --git a/ipaplatform/debian/paths.py b/ipaplatform/debian/paths.py index 35104b60b..fd795aa7d 100644 --- a/ipaplatform/debian/paths.py +++ b/ipaplatform/debian/paths.py @@ -34,6 +34,7 @@ class DebianPathNamespace(BasePathNamespace): HTTPD_PASSWORD_CONF = "/etc/apache2/password.conf" NAMED_CONF = "/etc/bind/named.conf" NAMED_CUSTOM_CONFIG = "/etc/bind/ipa-ext.conf" + NAMED_CUSTOM_OPTIONS_CONFIG = "/etc/bind/ipa-options-ext.conf" NAMED_VAR_DIR = "/var/cache/bind" NAMED_KEYTAB = "/etc/bind/named.keytab" NAMED_RFC1912_ZONES = "/etc/bind/named.conf.default-zones" diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py index f70acfde6..be117f963 100644 --- a/ipaserver/install/bindinstance.py +++ b/ipaserver/install/bindinstance.py @@ -295,7 +295,7 @@ def find_reverse_zone(ip_address, api=api): return None -def named_add_ext_conf_file(src, dest, t_params={}): +def named_add_ext_conf_file(src, dest, t_params=None): """ Ensure included file is present, but don't override it. @@ -303,6 +303,9 @@ def named_add_ext_conf_file(src, dest, t_params={}): :param dest: String. Absolute path to destination :param t_params: Dict. Parameters for source template """ + if t_params is None: + t_params = {} + if not os.path.exists(dest): ipa_ext_txt = ipautil.template_file(src, t_params) gid = pwd.getpwnam(constants.NAMED_USER).pw_gid @@ -837,6 +840,7 @@ class BindInstance(service.Service): BIND_LDAP_SO=paths.BIND_LDAP_SO, INCLUDE_CRYPTO_POLICY=crypto_policy, CUSTOM_CONFIG=paths.NAMED_CUSTOM_CONFIG, + CUSTOM_OPTIONS_CONFIG=paths.NAMED_CUSTOM_OPTIONS_CONFIG, NAMED_DATA_DIR=constants.NAMED_DATA_DIR, NAMED_ZONE_COMMENT=constants.NAMED_ZONE_COMMENT, ) @@ -988,20 +992,24 @@ class BindInstance(service.Service): named_txt = ipautil.template_file( os.path.join(paths.USR_SHARE_IPA_DIR, "bind.named.conf.template"), self.sub_dict) - named_fd = open(paths.NAMED_CONF, 'w') - named_fd.seek(0) - named_fd.truncate(0) - named_fd.write(named_txt) - named_fd.close() - named_add_ext_conf_file(paths.NAMED_CUSTOM_CFG_SRC, - paths.NAMED_CUSTOM_CONFIG) + gid = pwd.getpwnam(constants.NAMED_USER).pw_gid + with open(paths.NAMED_CONF, 'w') as named_conf: + os.fchmod(named_conf.fileno(), 0o640) + os.fchown(named_conf.fileno(), 0, gid) + named_conf.write(named_txt) - if self.no_dnssec_validation: - # disable validation - named_conf_set_directive("dnssec-validation", "no", - section=NAMED_SECTION_OPTIONS, - str_val=False) + named_add_ext_conf_file( + paths.NAMED_CUSTOM_CFG_SRC, + paths.NAMED_CUSTOM_CONFIG + ) + + dnssec_validation = 'no' if self.no_dnssec_validation else 'yes' + named_add_ext_conf_file( + paths.NAMED_CUSTOM_OPTIONS_CFG_SRC, + paths.NAMED_CUSTOM_OPTIONS_CONFIG, + {'NAMED_DNSSEC_VALIDATION': dnssec_validation} + ) # prevent repeated upgrade on new installs sysupgrade.set_upgrade_state( @@ -1260,5 +1268,6 @@ class BindInstance(service.Service): self.named_regular.start() ipautil.remove_file(paths.NAMED_CUSTOM_CONFIG) + ipautil.remove_file(paths.NAMED_CUSTOM_OPTIONS_CONFIG) ipautil.remove_keytab(self.keytab) ipautil.remove_ccache(run_as=self.service_user) diff --git a/ipaserver/install/ipa_backup.py b/ipaserver/install/ipa_backup.py index f0c9e5edf..e23a2dd79 100644 --- a/ipaserver/install/ipa_backup.py +++ b/ipaserver/install/ipa_backup.py @@ -125,6 +125,7 @@ class Backup(admintool.AdminTool): files = ( paths.NAMED_CONF, paths.NAMED_CUSTOM_CONFIG, + paths.NAMED_CUSTOM_OPTIONS_CONFIG, paths.NAMED_KEYTAB, paths.RESOLV_CONF, paths.SYSCONFIG_PKI_TOMCAT, diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index d513d100b..b62a9c8c0 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -594,9 +594,18 @@ def named_add_ipa_ext_conf_file(): logger.info('DNS is not configured.') return False - return bindinstance.named_add_ext_conf_file( - paths.NAMED_CUSTOM_CFG_SRC, - paths.NAMED_CUSTOM_CONFIG) + tasks = [ + bindinstance.named_add_ext_conf_file( + paths.NAMED_CUSTOM_CFG_SRC, + paths.NAMED_CUSTOM_CONFIG + ), + bindinstance.named_add_ext_conf_file( + paths.NAMED_CUSTOM_OPTIONS_CFG_SRC, + paths.NAMED_CUSTOM_OPTIONS_CONFIG + ) + ] + + return any(tasks) def named_set_minimum_connections():