Martin Kosek df13cdcb97 Forbid public access to DNS tree ...

With a publicly accessible DNS tree in LDAP, anyone with an access
to the LDAP server can get all DNS data as with a zone transfer
which is already restricted with ACL. Making DNS tree not readable
to public is a common security practice and should be applied
in FreeIPA as well.

This patch adds a new deny rule to forbid access to DNS tree to
users or hosts without an appropriate permission or users which
are not members of admins group. The new permission/aci is
applied both for new installs and upgraded servers.

bind-dyndb-ldap plugin is allowed to read DNS tree without any
change because its principal is already a member of "DNS
Servers" privilege.

https://fedorahosted.org/freeipa/ticket/2569

2012-04-01 21:17:04 -04:00

..

plugins

Forbid public access to DNS tree

2012-04-01 21:17:04 -04:00

__init__.py

Change FreeIPA license to GPLv3+

2010-12-20 17:19:53 -05:00

adtrustinstance.py

activate CLDAP

2011-12-06 08:29:53 -05:00

bindinstance.py

Improve user awareness about dnsconfig

2012-03-26 00:33:45 -04:00

cainstance.py

No longer shell escape the DM password when calling pkisilent.

2012-03-21 10:08:43 +01:00

certs.py

Move the compat module from ipalib to ipapython.

2012-02-13 22:22:49 -05:00

dsinstance.py

Fixed boot.ldif permission.

2012-04-01 16:54:55 -04:00

httpinstance.py

When changing multiple booleans with setsebool, pass each of them separately.

2012-03-23 10:19:47 +02:00

installutils.py

Improve hostname verification in install tools

2012-02-29 21:26:53 -05:00

krbinstance.py

Make sure the nolog argument to ipautil.run is not a bare string

2012-02-26 23:26:54 -05:00

ldapupdate.py

Don't check for schema uniqueness when comparing in ldapupdate.

2012-02-22 18:16:13 -05:00

Makefile.am

Add ipa-adtrust-install utility

2011-09-14 18:45:13 -04:00

memcacheinstance.py

Add ipa_memcached service

2012-02-09 13:20:28 -06:00

ntpinstance.py

ticket 2022 - modify codebase to utilize IPALogManager, obsoletes logging

2011-11-23 09:36:18 +01:00

replication.py

Fix ipa-replica-manage TLS connection error

2012-03-14 08:30:51 +01:00

service.py

Enable ipa_memcached when upgrading

2012-02-16 14:43:08 +01:00

upgradeinstance.py

Fix some issues introduced when rebasing update patch

2011-11-23 00:21:03 -05:00