mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
df13cdcb97
With a publicly accessible DNS tree in LDAP, anyone with an access to the LDAP server can get all DNS data as with a zone transfer which is already restricted with ACL. Making DNS tree not readable to public is a common security practice and should be applied in FreeIPA as well. This patch adds a new deny rule to forbid access to DNS tree to users or hosts without an appropriate permission or users which are not members of admins group. The new permission/aci is applied both for new installs and upgraded servers. bind-dyndb-ldap plugin is allowed to read DNS tree without any change because its principal is already a member of "DNS Servers" privilege. https://fedorahosted.org/freeipa/ticket/2569
79 lines
3.7 KiB
Plaintext
79 lines
3.7 KiB
Plaintext
dn: cn=dns,$SUFFIX
|
|
changetype: add
|
|
objectClass: idnsConfigObject
|
|
objectClass: nsContainer
|
|
objectClass: top
|
|
cn: dns
|
|
aci: (targetattr = "*")(version 3.0; acl "No access to DNS tree without a permission"; deny (read,search,compare) (groupdn != "ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX") and (groupdn != "ldap:///cn=read dns entries,cn=permissions,cn=pbac,$SUFFIX");)
|
|
|
|
dn: $SUFFIX
|
|
changetype: modify
|
|
add: aci
|
|
aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "permission:add dns entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX";)
|
|
aci: (target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "permission:remove dns entries";allow (delete) groupdn = "ldap:///cn=remove dns entries,cn=permissions,cn=pbac,$SUFFIX";)
|
|
aci: (targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "permission:update dns entries";allow (write) groupdn = "ldap:///cn=update dns entries,cn=permissions,cn=pbac,$SUFFIX";)
|
|
aci: (targetattr = "idnsforwardpolicy || idnsforwarders || idnsallowsyncptr || idnszonerefresh || idnspersistentsearch")(target = "ldap:///cn=dns,$SUFFIX")(version 3.0;acl "permission:Write DNS Configuration";allow (write) groupdn = "ldap:///cn=Write DNS Configuration,cn=permissions,cn=pbac,$SUFFIX";)
|
|
|
|
dn: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
changetype: add
|
|
objectClass: top
|
|
objectClass: groupofnames
|
|
objectClass: nestedgroup
|
|
cn: DNS Administrators
|
|
description: DNS Administrators
|
|
|
|
dn: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
|
|
changetype: add
|
|
objectClass: top
|
|
objectClass: groupofnames
|
|
objectClass: nestedgroup
|
|
cn: DNS Servers
|
|
description: DNS Servers
|
|
|
|
dn: cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX
|
|
changetype: add
|
|
objectClass: groupofnames
|
|
objectClass: top
|
|
cn: add dns entries
|
|
description: Add DNS entries
|
|
member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
|
|
|
|
dn: cn=remove dns entries,cn=permissions,cn=pbac,$SUFFIX
|
|
changetype: add
|
|
objectClass: groupofnames
|
|
objectClass: top
|
|
cn: remove dns entries
|
|
description: Remove DNS entries
|
|
member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
|
|
|
|
dn: cn=update dns entries,cn=permissions,cn=pbac,$SUFFIX
|
|
changetype: add
|
|
objectClass: groupofnames
|
|
objectClass: top
|
|
cn: update dns entries
|
|
description: Update DNS entries
|
|
member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
|
|
|
|
dn: cn=read dns entries,cn=permissions,cn=pbac,$SUFFIX
|
|
changetype: add
|
|
objectClass: top
|
|
objectClass: groupofnames
|
|
objectClass: ipapermission
|
|
cn: read dns entries
|
|
description: Read DNS entries
|
|
ipapermissiontype: SYSTEM
|
|
member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
|
|
|
|
dn: cn=Write DNS Configuration,cn=permissions,cn=pbac,$SUFFIX
|
|
changetype: add
|
|
objectClass: groupofnames
|
|
objectClass: top
|
|
cn: Write DNS Configuration
|
|
description: Write DNS Configuration
|
|
member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX
|
|
member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX
|