Martin Kosek df13cdcb97 Forbid public access to DNS tree ... With a publicly accessible DNS tree in LDAP, anyone with an access to the LDAP server can get all DNS data as with a zone transfer which is already restricted with ACL. Making DNS tree not readable to public is a common security practice and should be applied in FreeIPA as well. This patch adds a new deny rule to forbid access to DNS tree to users or hosts without an appropriate permission or users which are not members of admins group. The new permission/aci is applied both for new installs and upgraded servers. bind-dyndb-ldap plugin is allowed to read DNS tree without any change because its principal is already a member of "DNS Servers" privilege. https://fedorahosted.org/freeipa/ticket/2569		2012-04-01 21:17:04 -04:00
..
__init__.py	Add plugin framework to LDAP updates.	2011-11-22 23:57:10 -05:00
baseupdate.py	Add plugin framework to LDAP updates.	2011-11-22 23:57:10 -05:00
dns.py	Forbid public access to DNS tree	2012-04-01 21:17:04 -04:00
fix_replica_memberof.py	Handle updating replication agreements that lack nsDS5ReplicatedAttributeList	2012-04-02 10:49:20 +02:00
Makefile.am	Query and transfer ACLs for DNS zones	2012-02-24 09:40:43 +01:00
rename_managed.py	Add plugin framework to LDAP updates.	2011-11-22 23:57:10 -05:00
updateclient.py	Add plugin framework to LDAP updates.	2011-11-22 23:57:10 -05:00