On 08.12.2016 12:01, Brian Candler wrote:
FreeIPA (4.2.0) was installed with the DNS component enabled, but I want to pull this out. Is it possible to remove it and clean up the records which were already there?

e.g. is it sufficient just to delete everything under cn=dns,dc=example,dc=com ? I notice there are bunch of permissions entries in other parts of the tree which reference these with ipaPermTarget, do they have to go too?

Or would I have to re-install from scratch?




I suggest to keep DNS tree there and all permissions, just remove all zones using IPA API and disable DNS service and dnssyncd service in LDAP, because removing DNS completely is unsupported and untested

dn: cn=DNS,cn=vm-028.ipa.test,cn=masters,cn=ipa,cn=etc,$SUFFIX
objectClass: ipaConfigObject
objectClass: nsContainer
objectClass: top
ipaConfigString: startOrder 30
ipaConfigString: enabledService <--- remove this
cn: DNS

dn: cn=DNSKeySync,cn=vm-028.ipa.test,cn=masters,cn=ipa,$SUFFIX
objectClass: nsContainer
objectClass: top
ipaConfigString: dnssecVersion 1
ipaConfigString: startOrder 110
ipaConfigString: enabledService <---- remove this
cn: DNSKeySync

It will keep ipa dns* command working but without any effect

in case you *really* want to remove DNS completely, disable services ^, and revert everything added by https://github.com/freeipa/freeipa/blob/master/install/share/dns.ldif and https://github.com/freeipa/freeipa/blob/master/install/share/dnssec.ldif

But unsupported, nobody knows what may happen.


Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to