On Mon, 2014-12-29 at 16:53 -0500, Dmitri Pal wrote:
> On 12/29/2014 04:47 PM, Brendan Kearney wrote:
> > where can i find howto info around setting up bind-dyndb-ldap to accept
> > ddns updates from dhcp? usually, i have a shared key defined in dns and
> > dhcp, and the updates are authenticated. where are the docs for setting
> > this up in bind-dyndb-ldap?
> >
> I am not sure I understand the use case correctly.
> bind-dyndb-ldap isa back end driver for BIND to get data from an LDAP
> storage.
> The updates are done by BIND. The IPA BIND accepts kerberos based updates.
>
> http://www.freeipa.org/page/FreeIPAv2:Dynamic_updates_with_GSS-TSIG
>
> --
> Thank you,
> Dmitri Pal
>
> Sr. Engineering Manager IdM portfolio
> Red Hat, Inc.
>
this allows for a ticketed client to update DNS records directly, which
is not a best practice and is a huge security risk. clients should not
be able to manipulate DNS zones.
dynamic updates to DNS zones should come from DHCP, where dynamic
addressing is managed. as such, i have directives in DHCP and DNS to
establish authenticated updates between DHCP and DNS. for example:
/etc/named.conf:
key "dhcp" {
algorithm hmac-md5;
secret SomeRandomString;
};
...
zone "1.168.192.in-addr.arpa" IN {
type master;
file "dynamic/1.168.192.in-addr.arpa.db";
allow-update { key dhcp; };
};
zone "bpk2.com" IN {
type master;
file "dynamic/bpk2.com.db";
check-names ignore;
allow-update { key dhcp; };
};
/etc/dhcp/dhcpd.conf
key "dhcp"{
algorithm hmac-md5;
secret SomeRandomString;
};
zone 1.168.192.in-addr.arpa {
primary 192.168.1.1;
key dhcp;
}
zone bpk2.com {
primary 192.168.1.1;
key dhcp;
}
because the DHCP daemon is not kerberized, the update policies do not
seem to cover the situation where clients are not allowed to update DNS
zones themselves.
i am wondering how to manage DDNS updates from DHCP, where kerberized
updates are not likely going to happen.
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go To http://freeipa.org for more info on the project
