IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-11 16:51:55 -06:00
Code Issues Packages Projects Releases Wiki Activity
862340a3a1
freeipa/install/share/bind.ipa-options-ext.conf.template

19 lines
530 B
Plaintext
Raw Normal View History

Overhaul bind upgrade process /etc/named.conf is now owned by IPA. The file is overwritten on installation and all subsequent updates. All user modification will be lost. Config file creation and update use the same code paths. This simplifies upgrade process a lot. There is no errprone fiddling with config settings any more. During upgrade there is a one-time backup of named.conf to named.conf.ipa-backup. It allows users to salvage their customization and move them to one of two user config files which are included by named.conf. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-06-10 04:16:07 -05:00
/* User customization for BIND named
*
* This file is included in $NAMED_CONF and is not modified during IPA
* upgrades.
*
* It must only contain "options" settings. Any other setting must be
* configured in $NAMED_CUSTOM_CONF.
*
* Examples:
* allow-recursion { trusted_network; };
* allow-query-cache { trusted_network; };
*/
Split named custom config to allow changes in options stanza Upgrade path to add additional include to named.conf is not handled. Remove bindkeys-file directive from named config The ISC DVL service was shut down (https://www.isc.org/bind-keys/). BIND versions since April 2017 (i.e. 9.9.10, 9.10.5, 9.11.1 and later) include a hard-coded copy of the root KSK which gets updates automatically according to RFC 5011. Move dnssec-enable directive to custom named config Move comment named config being managed by FreeIPA to the top Move settings which could be changed by administrators to ipa-options-ext.conf. Settings defined there are sole responsibility of the administrator. We do not check if they might collide with our settings in named.conf. Fixes: https://pagure.io/freeipa/issue/8287 Co-authored-by: Peter Keresztes Schmidt <carbenium@outlook.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-04-25 11:06:45 -05:00
Overhaul bind upgrade process /etc/named.conf is now owned by IPA. The file is overwritten on installation and all subsequent updates. All user modification will be lost. Config file creation and update use the same code paths. This simplifies upgrade process a lot. There is no errprone fiddling with config settings any more. During upgrade there is a one-time backup of named.conf to named.conf.ipa-backup. It allows users to salvage their customization and move them to one of two user config files which are included by named.conf. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-06-10 04:16:07 -05:00
/* turns on IPv6 for port 53, IPv4 is on by default for all ifaces */
Split named custom config to allow changes in options stanza Upgrade path to add additional include to named.conf is not handled. Remove bindkeys-file directive from named config The ISC DVL service was shut down (https://www.isc.org/bind-keys/). BIND versions since April 2017 (i.e. 9.9.10, 9.10.5, 9.11.1 and later) include a hard-coded copy of the root KSK which gets updates automatically according to RFC 5011. Move dnssec-enable directive to custom named config Move comment named config being managed by FreeIPA to the top Move settings which could be changed by administrators to ipa-options-ext.conf. Settings defined there are sole responsibility of the administrator. We do not check if they might collide with our settings in named.conf. Fixes: https://pagure.io/freeipa/issue/8287 Co-authored-by: Peter Keresztes Schmidt <carbenium@outlook.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-04-25 11:06:45 -05:00
listen-on-v6 { any; };
/* dnssec-enable is obsolete and 'yes' by default */
dnssec-validation $NAMED_DNSSEC_VALIDATION;
Reference in New Issue Copy Permalink