Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.
Chapter 31. Managing DNS forwarding in IdM
Learn about configuring DNS global forwarders and DNS forward zones in the Identity Management (IdM) Web UI, the IdM CLI, and using Ansible.
31.1. The two roles of an IdM DNS server Link kopierenLink in die Zwischenablage kopiert!
DNS forwarding affects how a DNS service answers DNS queries. By default, the Berkeley Internet Name Domain (BIND) service integrated with IdM acts as both an authoritative and a recursive DNS server:
- Authoritative DNS server
- When a DNS client queries a name belonging to a DNS zone for which the IdM server is authoritative, BIND replies with data contained in the configured zone. Authoritative data always takes precedence over any other data.
- Recursive DNS server
- When a DNS client queries a name for which the IdM server is not authoritative, BIND attempts to resolve the query using other DNS servers. If forwarders are not defined, BIND asks the root servers on the Internet and uses a recursive resolution algorithm to answer the DNS query.
In some cases, it is not desirable to let BIND contact other DNS servers directly and perform the recursion based on data available on the Internet. You can configure BIND to use another DNS server, a forwarder, to resolve the query.
When you configure BIND to use a forwarder, queries and answers are forwarded back and forth between the IdM server and the forwarder, and the IdM server acts as the DNS cache for non-authoritative data.
31.2. Adding a global forwarder in the IdM Web UI Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to add a global DNS forwarder in the Identity Management (IdM) Web UI.
Prerequisites
- You are logged in to the IdM WebUI as IdM administrator.
- You know the Internet Protocol (IP) address of the DNS server to forward queries to.
Procedure
In the IdM Web UI, select
Network Services
DNS Global Configuration
DNS
.In the
DNS Global Configuration
section, clickAdd
.Specify the IP address of the DNS server that will receive forwarded DNS queries.
Select the
Forward policy
.-
Click
Save
at the top of the window.
Verification
Select
Network Services
DNS Global Configuration
DNS
.Verify that the global forwarder, with the forward policy you specified, is present and enabled in the IdM Web UI.
31.3. Adding a global forwarder in the CLI Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to add a global DNS forwarder by using the command line (CLI).
Prerequisites
- You are logged in as IdM administrator.
- You know the Internet Protocol (IP) address of the DNS server to forward queries to.
Procedure
Use the
ipa dnsconfig-mod
command to add a new global forwarder. Specify the IP address of the DNS forwarder with the--forwarder
option.ipa dnsconfig-mod --forwarder=10.10.0.1
[user@server ~]$ ipa dnsconfig-mod --forwarder=10.10.0.1 Server will check DNS forwarder(s). This may take some time, please wait ... Global forwarders: 10.10.0.1 IPA DNS servers: server.example.com
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
Use the
dnsconfig-show
command to display global forwarders.ipa dnsconfig-show
[user@server ~]$ ipa dnsconfig-show Global forwarders: 10.10.0.1 IPA DNS servers: server.example.com
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
31.4. Adding a DNS Forward Zone in the IdM Web UI Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to add a DNS forward zone in the Identity Management (IdM) Web UI.
Do not use forward zones unless absolutely required. Forward zones are not a standard solution, and using them can lead to unexpected and problematic behavior. If you must use forward zones, limit their use to overriding a global forwarding configuration.
When creating a new DNS zone, Red Hat recommends to always use standard DNS delegation using nameserver (NS) records and to avoid forward zones. In most cases, using a global forwarder is sufficient, and forward zones are not necessary.
Prerequisites
- You are logged in to the IdM WebUI as IdM administrator.
- You know the Internet Protocol (IP) address of the DNS server to forward queries to.
Procedure
In the IdM Web UI, select
Network Services
DNS Forward Zones
DNS
.In the
DNS Forward Zones
section, clickAdd
.In the
Add DNS forward zone
window, specify the forward zone name.Click the
Add
button and specify the IP address of a DNS server to receive the forwarding request. You can specify multiple forwarders per forward zone.Select the
Forward policy
.-
Click
Add
at the bottom of the window to add the new forward zone.
Verification
In the IdM Web UI, select
Network Services
DNS Forward Zones
DNS
.Verify that the forward zone you created, with the forwarders and forward policy you specified, is present and enabled in the IdM Web UI.
31.5. Adding a DNS Forward Zone in the CLI Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to add a DNS forward zone by using the command line (CLI).
Do not use forward zones unless absolutely required. Forward zones are not a standard solution, and using them can lead to unexpected and problematic behavior. If you must use forward zones, limit their use to overriding a global forwarding configuration.
When creating a new DNS zone, Red Hat recommends to always use standard DNS delegation using nameserver (NS) records and to avoid forward zones. In most cases, using a global forwarder is sufficient, and forward zones are not necessary.
Prerequisites
- You are logged in as IdM administrator.
- You know the Internet Protocol (IP) address of the DNS server to forward queries to.
Procedure
Use the
dnsforwardzone-add
command to add a new forward zone. Specify at least one forwarder with the--forwarder
option if the forward policy is notnone
, and specify the forward policy with the--forward-policy
option.ipa dnsforwardzone-add forward.example.com. --forwarder=10.10.0.14 --forwarder=10.10.1.15 --forward-policy=first
[user@server ~]$ ipa dnsforwardzone-add forward.example.com. --forwarder=10.10.0.14 --forwarder=10.10.1.15 --forward-policy=first Zone name: forward.example.com. Zone forwarders: 10.10.0.14, 10.10.1.15 Forward policy: first
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
Use the
dnsforwardzone-show
command to display the DNS forward zone you just created.ipa dnsforwardzone-show forward.example.com.
[user@server ~]$ ipa dnsforwardzone-show forward.example.com. Zone name: forward.example.com. Zone forwarders: 10.10.0.14, 10.10.1.15 Forward policy: first
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
31.6. Establishing a DNS Global Forwarder in IdM using Ansible Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to use an Ansible playbook to establish a DNS Global Forwarder in IdM.
In the example procedure below, the IdM administrator creates a DNS global forwarder to a DNS server with an Internet Protocol (IP) v4 address of 8.8.6.6
and IPv6 address of 2001:4860:4860::8800
on port 53
.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.15 or later.
-
You have installed the
freeipa.ansible_freeipa
collection. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
and that you have access to a file that stores the password protecting the secret.yml file.
-
The target node, that is the node on which the
freeipa.ansible_freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the
/usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
directory:cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
$ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Make a copy of the
set-configuration.yml
Ansible playbook file. For example:cp set-configuration.yml establish-global-forwarder.yml
$ cp set-configuration.yml establish-global-forwarder.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Open the
establish-global-forwarder.yml
file for editing. Adapt the file by setting the following variables:
-
Change the
name
variable for the playbook toPlaybook to establish a global forwarder in IdM DNS
. -
In the
tasks
section, change thename
of the task toCreate a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800
. In the
forwarders
section of thefreeipa.ansible_freeipa.ipadnsconfig
portion:-
Change the first
ip_address
value to the IPv4 address of the global forwarder:8.8.6.6
. -
Change the second
ip_address
value to the IPv6 address of the global forwarder:2001:4860:4860::8800
. -
Verify the
port
value is set to53
.
-
Change the first
Change the
forward_policy
tofirst
.This the modified Ansible playbook file for the current example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Change the
- Save the file.
Run the playbook:
ansible-playbook --vault-password-file=password_file -v -i inventory.file establish-global-forwarder.yml
$ ansible-playbook --vault-password-file=password_file -v -i inventory.file establish-global-forwarder.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
31.7. Ensuring DNS Global Forwarders are disabled in IdM using Ansible Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to use an Ansible playbook to ensure DNS Global Forwarders are disabled in IdM. In the example procedure below, the IdM administrator ensures that the forwarding policy for the global forwarder is set to none
, which effectively disables the global forwarder.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.15 or later.
-
You have installed the
freeipa.ansible_freeipa
collection. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
and that you have access to a file that stores the password protecting the secret.yml file.
-
The target node, that is the node on which the
freeipa.ansible_freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the
/usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
directory:cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
$ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Verify the contents of the
disable-global-forwarders.yml
Ansible playbook file which is already configured to disable all DNS global forwarders. For example:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Run the playbook:
ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders.yml
$ ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
31.8. Ensuring the presence of a DNS Forward Zone in IdM using Ansible Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to use an Ansible playbook to ensure the presence of a DNS Forward Zone in IdM. In the example procedure below, the IdM administrator ensures the presence of a DNS forward zone for example.com
to a DNS server with an Internet Protocol (IP) address of 8.8.8.8
.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.15 or later.
-
You have installed the
freeipa.ansible_freeipa
collection. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
and that you have access to a file that stores the password protecting the secret.yml file.
-
The target node, that is the node on which the
freeipa.ansible_freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the
/usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
directory:cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
$ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Make a copy of the
forwarders-absent.yml
Ansible playbook file. For example:cp forwarders-absent.yml ensure-presence-forwardzone.yml
$ cp forwarders-absent.yml ensure-presence-forwardzone.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Open the
ensure-presence-forwardzone.yml
file for editing. Adapt the file by setting the following variables:
-
Change the
name
variable for the playbook toPlaybook to ensure the presence of a dnsforwardzone in IdM DNS
. -
In the
tasks
section, change thename
of the task toEnsure presence of a dnsforwardzone for example.com to 8.8.8.8
. -
In the
tasks
section, change thefreeipa.ansible_freeipa.ipadnsconfig
heading tofreeipa.ansible_freeipa.ipadnsforwardzone
. In the
freeipa.ansible_freeipa.ipadnsforwardzone
section:-
Indicate that the value of the
ipaadmin_password
variable is defined in the secret.yml Ansible vault file. -
Add the
name
variable and set it toexample.com
. In the
forwarders
section:-
Remove the
ip_address
andport
lines. Add the IP address of the DNS server to receive forwarded requests by specifying it after a dash:
- 8.8.8.8
- 8.8.8.8
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
-
Remove the
-
Add the
forwardpolicy
variable and set it tofirst
. -
Add the
skip_overlap_check
variable and set it totrue
. -
Change the
state
variable topresent
.
This the modified Ansible playbook file for the current example:
-
Indicate that the value of the
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Change the
- Save the file.
Run the playbook:
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-forwardzone.yml
$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-forwardzone.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
31.9. Ensuring a DNS Forward Zone has multiple forwarders in IdM using Ansible Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to use an Ansible playbook to ensure a DNS Forward Zone in IdM has multiple forwarders. In the example procedure below, the IdM administrator ensures the DNS forward zone for example.com
is forwarding to 8.8.8.8
and 4.4.4.4
.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.15 or later.
-
You have installed the
freeipa.ansible_freeipa
collection. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
and that you have access to a file that stores the password protecting the secret.yml file.
-
The target node, that is the node on which the
freeipa.ansible_freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the
/usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
directory:cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
$ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Make a copy of the
forwarders-absent.yml
Ansible playbook file. For example:cp forwarders-absent.yml ensure-presence-multiple-forwarders.yml
$ cp forwarders-absent.yml ensure-presence-multiple-forwarders.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Open the
ensure-presence-multiple-forwarders.yml
file for editing. Adapt the file by setting the following variables:
-
Change the
name
variable for the playbook toPlaybook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS
. -
In the
tasks
section, change thename
of the task toEnsure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com
. -
In the
tasks
section, change thefreeipa.ansible_freeipa.ipadnsconfig
heading tofreeipa.ansible_freeipa.ipadnsforwardzone
. In the
freeipa.ansible_freeipa.ipadnsforwardzone
section:-
Indicate that the value of the
ipaadmin_password
variable is defined in the secret.yml Ansible vault file. -
Add the
name
variable and set it toexample.com
. In the
forwarders
section:-
Remove the
ip_address
andport
lines. Add the IP address of the DNS servers you want to ensure are present, preceded by a dash:
- 8.8.8.8 - 4.4.4.4
- 8.8.8.8 - 4.4.4.4
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
-
Remove the
- Change the state variable to present.
This the modified Ansible playbook file for the current example:
-
Indicate that the value of the
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Change the
- Save the file.
Run the playbook:
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-forwarders.yml
$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-forwarders.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
31.10. Ensuring a DNS Forward Zone is disabled in IdM using Ansible Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to use an Ansible playbook to ensure a DNS Forward Zone is disabled in IdM. In the example procedure below, the IdM administrator ensures the DNS forward zone for example.com
is disabled.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.15 or later.
-
You have installed the
freeipa.ansible_freeipa
collection. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
and that you have access to a file that stores the password protecting the secret.yml file.
-
The target node, that is the node on which the
freeipa.ansible_freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the
/usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
directory:cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
$ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Make a copy of the
forwarders-absent.yml
Ansible playbook file. For example:cp forwarders-absent.yml ensure-disabled-forwardzone.yml
$ cp forwarders-absent.yml ensure-disabled-forwardzone.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Open the
ensure-disabled-forwardzone.yml
file for editing. Adapt the file by setting the following variables:
-
Change the
name
variable for the playbook toPlaybook to ensure a dnsforwardzone is disabled in IdM DNS
. -
In the
tasks
section, change thename
of the task toEnsure a dnsforwardzone for example.com is disabled
. -
In the
tasks
section, change thefreeipa.ansible_freeipa.ipadnsconfig
heading tofreeipa.ansible_freeipa.ipadnsforwardzone
. In the
freeipa.ansible_freeipa.ipadnsforwardzone
section:-
Indicate that the value of the
ipaadmin_password
variable is defined in the secret.yml Ansible vault file. -
Add the
name
variable and set it toexample.com
. -
Remove the entire
forwarders
section. -
Change the
state
variable todisabled
.
This the modified Ansible playbook file for the current example:
-
Indicate that the value of the
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Change the
- Save the file.
Run the playbook:
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-disabled-forwardzone.yml
$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-disabled-forwardzone.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
31.11. Ensuring the absence of a DNS Forward Zone in IdM using Ansible Link kopierenLink in die Zwischenablage kopiert!
Follow this procedure to use an Ansible playbook to ensure the absence of a DNS Forward Zone in IdM. In the example procedure below, the IdM administrator ensures the absence of a DNS forward zone for example.com
.
Prerequisites
You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.15 or later.
-
You have installed the
freeipa.ansible_freeipa
collection. - The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
-
The example assumes that the secret.yml Ansible vault stores your
ipaadmin_password
and that you have access to a file that stores the password protecting the secret.yml file.
-
The target node, that is the node on which the
freeipa.ansible_freeipa
module is executed, is part of the IdM domain as an IdM client, server or replica.
Procedure
Navigate to the
/usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
directory:cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
$ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Make a copy of the
forwarders-absent.yml
Ansible playbook file. For example:cp forwarders-absent.yml ensure-absence-forwardzone.yml
$ cp forwarders-absent.yml ensure-absence-forwardzone.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Open the
ensure-absence-forwardzone.yml
file for editing. Adapt the file by setting the following variables:
-
Change the
name
variable for the playbook toPlaybook to ensure the absence of a dnsforwardzone in IdM DNS
. -
In the
tasks
section, change thename
of the task toEnsure the absence of a dnsforwardzone for example.com
. -
In the
tasks
section, change thefreeipa.ansible_freeipa.ipadnsconfig
heading tofreeipa.ansible_freeipa.ipadnsforwardzone
. In the
freeipa.ansible_freeipa.ipadnsforwardzone
section:-
Indicate that the value of the
ipaadmin_password
variable is defined in the secret.yml Ansible vault file. -
Add the
name
variable and set it toexample.com
. -
Remove the entire
forwarders
section. -
Leave the
state
variable asabsent
.
This the modified Ansible playbook file for the current example:
-
Indicate that the value of the
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Change the
- Save the file.
Run the playbook:
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-forwardzone.yml
$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-forwardzone.yml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow