Chapter 6. Managing DNS forwarding in IdM

Procedure

1. In the IdM Web UI, select Network Services DNS Global Configuration DNS.

   

2. In the DNS Global Configuration section, click Add.

   

3. Specify the IP address of the DNS server that will receive forwarded DNS queries.

   

4. Select the Forward policy.

   
5. Click Save at the top of the window.

Verification

1. Select Network Services DNS Global Configuration DNS.

   

2. Verify that the global forwarder, with the forward policy you specified, is present and enabled in the IdM Web UI.

   

Procedure

1. In the IdM Web UI, select Network Services DNS Forward Zones DNS.

   

2. In the DNS Forward Zones section, click Add.

   

3. In the Add DNS forward zone window, specify the forward zone name.

   

4. Click the Add button and specify the IP address of a DNS server to receive the forwarding request. You can specify multiple forwarders per forward zone.

   

5. Select the Forward policy.

   
6. Click Add at the bottom of the window to add the new forward zone.

Verification

1. In the IdM Web UI, select Network Services DNS Forward Zones DNS.

   

2. Verify that the forward zone you created, with the forwarders and forward policy you specified, is present and enabled in the IdM Web UI.

   

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the set-configuration.yml Ansible playbook file. For example:

   $ cp set-configuration.yml establish-global-forwarder.yml

4. Open the establish-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to establish a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.

   4. Change the forward_policy to first.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to establish a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800
       ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         forward_policy: first
         allow_sync_ptr: true

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file establish-global-forwarder.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml

4. Open the ensure-presence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 7.7.9.9.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:db8::1:0.
      3. Verify the port value is set to 53.

   4. Change the state to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 7.7.9.9
           - ip_address: 2001:db8::1:0
             port: 53
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml

4. Open the ensure-absence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.
   4. Set the action variable to member.
   5. Verify the state is set to absent.

   This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         action: member
         state: absent

   Important

   If you only use the state: absent option in your playbook without also using action: member, the playbook fails.

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Verify the contents of the disable-global-forwarders.yml Ansible playbook file which is already configured to disable all DNS global forwarders. For example:

   $ cat disable-global-forwarders.yml
   ---
   - name: Playbook to disable global DNS forwarders
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Disable global forwarders.
       ipadnsconfig:
         forward_policy: none

4. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-forwardzone.yml

4. Open the ensure-presence-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure presence of a dnsforwardzone for example.com to 8.8.8.8.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.

      3. In the forwarders section:

         1. Remove the ip_address and port lines.

         2. Add the IP address of the DNS server to receive forwarded requests by specifying it after a dash:

            - 8.8.8.8

      4. Add the forwardpolicy variable and set it to first.
      5. Add the skip_overlap_check variable and set it to true.
      6. Change the state variable to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a dnsforwardzone for example.com to 8.8.8.8
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: example.com
         forwarders:
             - 8.8.8.8
         forwardpolicy: first
         skip_overlap_check: true
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-forwardzone.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-multiple-forwarders.yml

4. Open the ensure-presence-multiple-forwarders.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.

      3. In the forwarders section:

         1. Remove the ip_address and port lines.

         2. Add the IP address of the DNS servers you want to ensure are present, preceded by a dash:

            - 8.8.8.8
            - 4.4.4.4

      4. Change the state variable to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: name: Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
        name: example.com
         forwarders:
             - 8.8.8.8
             - 4.4.4.4
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-forwarders.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-disabled-forwardzone.yml

4. Open the ensure-disabled-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure a dnsforwardzone is disabled in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure a dnsforwardzone for example.com is disabled.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.
      3. Remove the entire forwarders section.
      4. Change the state variable to disabled.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure a dnsforwardzone is disabled in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure a dnsforwardzone for example.com is disabled
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: example.com
         state: disabled

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-disabled-forwardzone.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-forwardzone.yml

4. Open the ensure-absence-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a dnsforwardzone for example.com.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.
      3. Remove the entire forwarders section.
      4. Leave the state variable as absent.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a dnsforwardzone for example.com
       ipadnsforwardzone:
          ipaadmin_password: "{{ ipaadmin_password }}"
          name: example.com
          state: absent

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-forwardzone.yml