Re: [Freeipa-devel] [PATCH] 271 Fill new DNS zone update policy by default

2012-06-05 Thread Martin Kosek
On Mon, 2012-06-04 at 22:39 -0400, Rob Crittenden wrote: Martin Kosek wrote: For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy

Re: [Freeipa-devel] [PATCH] 271 Fill new DNS zone update policy by default

2012-06-05 Thread Martin Kosek
On Tue, 2012-06-05 at 14:44 +0930, William Brown wrote: I think the example should be something like: Modify the zone to allow dynamic updates for hosts own records in realm EXAMPLE.COM: ipa dnszone-mod example.com --dynamic-update=TRUE This is the equivalent of: ipa

[Freeipa-devel] [PATCH] 271 Fill new DNS zone update policy by default

2012-06-04 Thread Martin Kosek
For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just

Re: [Freeipa-devel] [PATCH] 271 Fill new DNS zone update policy by default

2012-06-04 Thread Rob Crittenden
Martin Kosek wrote: For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by

Re: [Freeipa-devel] [PATCH] 271 Fill new DNS zone update policy by default

2012-06-04 Thread William Brown
I think the example should be something like: Modify the zone to allow dynamic updates for hosts own records in realm EXAMPLE.COM: ipa dnszone-mod example.com --dynamic-update=TRUE This is the equivalent of: ipa dnszone-mod example.com --dynamic-update=TRUE \\