Martin Kosek df13cdcb97 Forbid public access to DNS tree ...

With a publicly accessible DNS tree in LDAP, anyone with an access
to the LDAP server can get all DNS data as with a zone transfer
which is already restricted with ACL. Making DNS tree not readable
to public is a common security practice and should be applied
in FreeIPA as well.

This patch adds a new deny rule to forbid access to DNS tree to
users or hosts without an appropriate permission or users which
are not members of admins group. The new permission/aci is
applied both for new installs and upgraded servers.

bind-dyndb-ldap plugin is allowed to read DNS tree without any
change because its principal is already a member of "DNS
Servers" privilege.

https://fedorahosted.org/freeipa/ticket/2569

2012-04-01 21:17:04 -04:00

..

__init__.py

Add plugin framework to LDAP updates.

2011-11-22 23:57:10 -05:00

baseupdate.py

Add plugin framework to LDAP updates.

2011-11-22 23:57:10 -05:00

dns.py

Forbid public access to DNS tree

2012-04-01 21:17:04 -04:00

fix_replica_memberof.py

Handle updating replication agreements that lack nsDS5ReplicatedAttributeList

2012-04-02 10:49:20 +02:00

Makefile.am

Query and transfer ACLs for DNS zones

2012-02-24 09:40:43 +01:00

rename_managed.py

Add plugin framework to LDAP updates.

2011-11-22 23:57:10 -05:00

updateclient.py

Add plugin framework to LDAP updates.

2011-11-22 23:57:10 -05:00