Working with DNS in Identity Management

1. The DNS installation script creates an /etc/NetworkManager/conf.d/zzz-ipa.conf NetworkManager configuration file to control the search order and DNS server list:

   # auto-generated by IPA installer
   [main]
   dns=default
   
   [global-dns]
   searches=$DOMAIN
   
   [global-dns-domain-*]
   servers=127.0.0.1

2. The NetworkManager service is reloaded, which always creates the /etc/resolv.conf file with the settings from the last file in the /etc/NetworkManager/conf.d/ directory. This is in this case the zzz-ipa.conf file.

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml

4. Open the ensure-presence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 7.7.9.9.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:db8::1:0.
      3. Verify the port value is set to 53.

   4. Change the state to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 7.7.9.9
           - ip_address: 2001:db8::1:0
             port: 53
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml

4. Open the ensure-absence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.
   4. Set the action variable to member.
   5. Verify the state is set to absent.

   This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         action: member
         state: absent

   Important

   If you only use the state: absent option in your playbook without also using action: member, the playbook fails.

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the set-configuration.yml Ansible playbook file. For example:

   $ cp set-configuration.yml set-forward-policy-to-first.yml

4. Open the set-forward-policy-to-first.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsconfig task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the forward_policy variable to first.

     Delete all the other lines of the original playbook that are irrelevant. This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to set global forwarding policy to first
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Set global forwarding policy to first.
       ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         forward_policy: first

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file set-forward-policy-to-first.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the disable-global-forwarders.yml Ansible playbook file. For example:

   $ cp disable-global-forwarders.yml disable-global-forwarders-copy.yml

4. Open the disable-global-forwarders-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsconfig task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the forward_policy variable to none.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to disable global DNS forwarders
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Disable global forwarders.
       ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         forward_policy: none

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders-copy.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the disallow-reverse-sync.yml Ansible playbook file. For example:

   $ cp disallow-reverse-sync.yml disallow-reverse-sync-copy.yml

4. Open the disallow-reverse-sync-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsconfig task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the allow_sync_ptr variable to no.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to disallow reverse record synchronization
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Disallow reverse record synchronization.
       ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         allow_sync_ptr: no

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disallow-reverse-sync-copy.yml

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

   Figure 2.1. Managing IdM DNS primary zones

   
2. Click Add at the top of the list of all zones.

3. Provide the zone name.

   Figure 2.2. Entering an new IdM primary zone

   
4. Click Add.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

2. Select the check box by the zone name and click Delete.

   Figure 2.3. Removing a primary DNS Zone

   
3. In the Remove DNS zones dialog window, confirm that you want to delete the selected zone.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

   Figure 2.4. DNS primary zones management

   

2. In the DNS Zones section, click on the zone name in the list of all zones to open the DNS zone page.

   Figure 2.5. Editing a primary zone

   

3. Click Settings.

   Figure 2.6. The Settings tab in the primary zone edit page

   

4. Change the zone configuration as required.

   For information about the available settings, see IdM DNS zone attributes.

5. Click Save to confirm the new configuration.

   Note

   If you are changing the default time to live (TTL) of a zone, restart the named-pkcs11 service on all IdM DNS servers to make the changes take effect. All other settings are automatically activated immediately.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click Settings.

3. Under Allow transfer, specify the name servers to which you want to transfer the zone records.

   Figure 2.7. Enabling zone transfers

   
4. Click Save at the top of the DNS zone page to confirm the new configuration.

Verification

1. SSH to one of the DNS servers to which zone transfer has been enabled:

   $ ssh 192.0.2.1

2. Transfer the IdM DNS zone using a tool such as the dig utility:

   # dig @ipa-server zone_name AXFR

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnszone directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnszone

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the dnszone-present.yml Ansible playbook file. For example:

   $ cp dnszone-present.yml dnszone-present-copy.yml

4. Open the dnszone-present-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnszone task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the zone_name variable to zone.idm.example.com.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-present-copy.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnszone directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnszone

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the dnszone-all-params.yml Ansible playbook file. For example:

   $ cp dnszone-all-params.yml dnszone-all-params-copy.yml

4. Open the dnszone-all-params-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnszone task section:

   • Set the ipaadmin_password variable to your IdM administrator password.
   • Set the zone_name variable to zone.idm.example.com.
   • Set the allow_sync_ptr variable to true if you want to allow the synchronization of forward and reverse records, that is the synchronization of A and AAAA records with PTR records.
   • Set the dynamic_update variable to true to enable IdM client machines to add or update their IP addresses.
   • Set the dnssec variable to true to allow inline DNSSEC signing of records in the zone.
   • Set the allow_transfer variable to the IP addresses of secondary name servers in the zone.
   • Set the allow_query variable to the IP addresses or networks that are allowed to issue queries.
   • Set the forwarders variable to the IP addresses of global forwarders.
   • Set the serial variable to the SOA record serial number.
   • Define the refresh, retry, expire, minimum, ttl, and default_ttl values for DNS records in the zone.
   • Define the NSEC3PARAM record for the zone using the nsec3param_rec variable.
   • Set the skip_overlap_check variable to true to force DNS creation even if it overlaps with an existing zone.

   • Set the skip_nameserver_check to true to force DNS zone creation even if the nameserver is not resolvable.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         allow_sync_ptr: true
         dynamic_update: true
         dnssec: true
         allow_transfer:
           - 1.1.1.1
           - 2.2.2.2
         allow_query:
           - 1.1.1.1
           - 2.2.2.2
         forwarders:
           - ip_address: 8.8.8.8
           - ip_address: 8.8.4.4
             port: 52
         serial: 1234
         refresh: 3600
         retry: 900
         expire: 1209600
         minimum: 3600
         ttl: 60
         default_ttl: 90
         name_server: server.idm.example.com.
         admin_email: admin.admin@idm.example.com
         nsec3param_rec: "1 7 100 0123456789abcdef"
         skip_overlap_check: true
         skip_nameserver_check: true
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-all-params-copy.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnszone directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnszone

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the dnszone-reverse-from-ip.yml Ansible playbook file. For example:

   $ cp dnszone-reverse-from-ip.yml dnszone-reverse-from-ip-copy.yml

4. Open the dnszone-reverse-from-ip-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnszone task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the name_from_ip variable to the IP of your IdM nameserver, and provide its prefix length.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Ensure dnszone present
       hosts: ipaserver
       become: true
     
       tasks:
       - name: Ensure zone for reverse DNS lookup is present.
         ipadnszone:
           ipaadmin_password: "{{ ipaadmin_password }}"
           name_from_ip: 192.168.1.2/24
           state: present
         register: result
       - name: Display inferred zone name.
         debug:
           msg: "Zone name: {{ result.dnszone.name }}"

   The playbook creates a zone for reverse DNS lookup from the 192.168.1.2 IP address and its prefix length of 24. Next, the playbook displays the resulting zone name.

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-reverse-from-ip-copy.yml

Procedure

1. Open the IPA Server tab.
2. Select Topology subtab.
3. Click IPA Locations in the navigation bar.
4. Click Add at the top of the locations list.
5. Fill in the location name.
6. Click the Add button to save the location.
7. Optional: Repeat the steps to add further locations.

Procedure

1. For example, to create a new location germany, enter:

   $ ipa location-add germany
   ----------------------------
   Added IPA location "germany"
   ----------------------------
     Location name: germany

2. Optional: Repeat the step to add further locations.

Procedure

1. Open the IPA Server tab.
2. Select the Topology subtab.
3. Click IPA Servers in the navigation.
4. Click on the IdM server name.

5. Select a DNS location, and optionally set a service weight:

   Figure 4.1. Assigning a server to a DNS location

   
6. Click Save.

7. In the command-line interface (CLI) of the host you assigned in the previous steps the DNS location to, restart the named-pkcs11 service:

   [root@idmserver-01 ~]# systemctl restart named-pkcs11

8. Optional: Repeat the steps to assign DNS locations to further IdM servers.

Procedure

1. Optional: List all configured DNS locations:

   [root@server ~]# ipa location-find
   -----------------------
   2 IPA locations matched
   -----------------------
   Location name: australia
   Location name: germany
   -----------------------------
   Number of entries returned: 2
   -----------------------------

2. Assign the server to the DNS location. For example, to assign the location germany to the server idmserver-01.idm.example.com, run:

   # ipa server-mod idmserver-01.idm.example.com --location=germany
   ipa: WARNING: Service named-pkcs11.service requires restart on IPA server
   idmserver-01.idm.example.com to apply configuration changes.
   --------------------------------------------------
   Modified IPA server "idmserver-01.idm.example.com"
   --------------------------------------------------
   Servername: idmserver-01.idm.example.com
   Min domain level: 0
   Max domain level: 1
   Location: germany
   Enabled server roles: DNS server, NTP server

3. Restart the named-pkcs11 service on the host you assigned in the previous steps the DNS location to:

   # systemctl restart named-pkcs11

4. Optional: Repeat the steps to assign DNS locations to further IdM servers.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the location-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/location/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/location/location-present.yml location-present-copy.yml

3. Open the location-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipalocation task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the location.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: location present example
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure that the "germany" location is present
       ipalocation:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: germany

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory location-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the location-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/location/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/location/location-absent.yml location-absent-copy.yml

3. Open the location-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipalocation task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the DNS location.
   • Make sure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: location absent example
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure that the "germany" location is absent
       ipalocation:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: germany
         state: absent

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory location-absent-copy.yml

Procedure

1. In the IdM Web UI, select Network Services → DNS Global Configuration → DNS.

   

2. In the DNS Global Configuration section, click Add.

   

3. Specify the IP address of the DNS server that will receive forwarded DNS queries.

   

4. Select the Forward policy.

   
5. Click Save at the top of the window.

Verification

1. Select Network Services → DNS Global Configuration → DNS.

   

2. Verify that the global forwarder, with the forward policy you specified, is present and enabled in the IdM Web UI.

   

Procedure

1. In the IdM Web UI, select Network Services → DNS Forward Zones → DNS.

   

2. In the DNS Forward Zones section, click Add.

   

3. In the Add DNS forward zone window, specify the forward zone name.

   

4. Click the Add button and specify the IP address of a DNS server to receive the forwarding request. You can specify multiple forwarders per forward zone.

   

5. Select the Forward policy.

   
6. Click Add at the bottom of the window to add the new forward zone.

Verification

1. In the IdM Web UI, select Network Services → DNS Forward Zones → DNS.

   

2. Verify that the forward zone you created, with the forwarders and forward policy you specified, is present and enabled in the IdM Web UI.

   

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the set-configuration.yml Ansible playbook file. For example:

   $ cp set-configuration.yml establish-global-forwarder.yml

4. Open the establish-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to establish a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.

   4. Change the forward_policy to first.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to establish a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800
       ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         forward_policy: first
         allow_sync_ptr: true

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file establish-global-forwarder.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml

4. Open the ensure-presence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 7.7.9.9.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:db8::1:0.
      3. Verify the port value is set to 53.

   4. Change the state to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 7.7.9.9
           - ip_address: 2001:db8::1:0
             port: 53
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml

4. Open the ensure-absence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.
   4. Set the action variable to member.
   5. Verify the state is set to absent.

   This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         action: member
         state: absent

   Important

   If you only use the state: absent option in your playbook without also using action: member, the playbook fails.

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Verify the contents of the disable-global-forwarders.yml Ansible playbook file which is already configured to disable all DNS global forwarders. For example:

   $ cat disable-global-forwarders.yml
   ---
   - name: Playbook to disable global DNS forwarders
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Disable global forwarders.
       ipadnsconfig:
         forward_policy: none

4. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-forwardzone.yml

4. Open the ensure-presence-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure presence of a dnsforwardzone for example.com to 8.8.8.8.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.

      3. In the forwarders section:

         1. Remove the ip_address and port lines.

         2. Add the IP address of the DNS server to receive forwarded requests by specifying it after a dash:

            - 8.8.8.8

      4. Add the forwardpolicy variable and set it to first.
      5. Add the skip_overlap_check variable and set it to true.
      6. Change the state variable to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a dnsforwardzone for example.com to 8.8.8.8
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: example.com
         forwarders:
             - 8.8.8.8
         forwardpolicy: first
         skip_overlap_check: true
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-forwardzone.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-multiple-forwarders.yml

4. Open the ensure-presence-multiple-forwarders.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.

      3. In the forwarders section:

         1. Remove the ip_address and port lines.

         2. Add the IP address of the DNS servers you want to ensure are present, preceded by a dash:

            - 8.8.8.8
            - 4.4.4.4

      4. Change the state variable to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: name: Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
        name: example.com
         forwarders:
             - 8.8.8.8
             - 4.4.4.4
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-forwarders.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-disabled-forwardzone.yml

4. Open the ensure-disabled-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure a dnsforwardzone is disabled in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure a dnsforwardzone for example.com is disabled.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.
      3. Remove the entire forwarders section.
      4. Change the state variable to disabled.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure a dnsforwardzone is disabled in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure a dnsforwardzone for example.com is disabled
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: example.com
         state: disabled

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-disabled-forwardzone.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-forwardzone.yml

4. Open the ensure-absence-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a dnsforwardzone for example.com.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.
      3. Remove the entire forwarders section.
      4. Leave the state variable as absent.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a dnsforwardzone for example.com
       ipadnsforwardzone:
          ipaadmin_password: "{{ ipaadmin_password }}"
          name: example.com
          state: absent

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-forwardzone.yml

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the DNS zone to which you want to add a DNS record.

3. In the DNS Resource Records section, click Add to add a new record.

   Figure 7.1. Adding a New DNS Resource Record

   

4. Select the type of record to create and fill out the other fields as required.

   Figure 7.2. Defining a New DNS Resource Record

   
5. Click Add to confirm the new record.

Procedure

1. To add a DNS resource record, use the ipa dnsrecord-add command. The command follows this syntax:

   $ ipa dnsrecord-add zone_name record_name --record_type_option=data

   In the command above:

   • The zone_name is the name of the DNS zone to which the record is being added.
   • The record_name is an identifier for the new DNS resource record.

   For example, to add an A type DNS record of host1 to the idm.example.com zone, enter:

   $ ipa dnsrecord-add idm.example.com host1 --a-rec=192.168.122.123

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the zone from which you want to delete a DNS record, for example example.com..

3. In the DNS Resource Records section, click the name of the resource record.

   Figure 7.3. Selecting a DNS Resource Record

   
4. Select the check box by the name of the record type to delete.

5. Click Delete.

   Figure 7.4. Deleting a DNS Resource Record

   

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the zone from which you want to delete a DNS record, for example zone.example.com..
3. In the DNS Resource Records section, select the check box of the resource record to delete.

4. Click Delete.

   Figure 7.5. Deleting an Entire Resource Record

   

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the ensure-A-and-AAAA-records-are-present.yml Ansible playbook file. For example:

   $ cp ensure-A-and-AAAA-records-are-present.yml ensure-A-and-AAAA-records-are-present-copy.yml

4. Open the ensure-A-and-AAAA-records-are-present-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsrecord task section:

   • Set the ipaadmin_password variable to your IdM administrator password.
   • Set the zone_name variable to idm.example.com.
   • In the records variable, set the name variable to host1, and the a_ip_address variable to 192.168.122.123.

   • In the records variable, set the name variable to host1, and the aaaa_ip_address variable to ::1.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure A and AAAA records are present
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     # Ensure A and AAAA records are present
     - name: Ensure that 'host1' has A and AAAA records.
       ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: idm.example.com
         records:
         - name: host1
           a_ip_address: 192.168.122.123
         - name: host1
           aaaa_ip_address: ::1

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-A-and-AAAA-records-are-present-copy.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the ensure-dnsrecord-with-reverse-is-present.yml Ansible playbook file. For example:

   $ cp ensure-dnsrecord-with-reverse-is-present.yml ensure-dnsrecord-with-reverse-is-present-copy.yml

4. Open the ensure-dnsrecord-with-reverse-is-present-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsrecord task section:

   • Set the ipaadmin_password variable to your IdM administrator password.
   • Set the name variable to host1.
   • Set the zone_name variable to idm.example.com.
   • Set the ip_address variable to 192.168.122.45.

   • Set the create_reverse variable to true.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure DNS Record is present.
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     # Ensure that dns record is present
     - ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: host1
         zone_name: idm.example.com
         ip_address: 192.168.122.45
         create_reverse: true
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-dnsrecord-with-reverse-is-present-copy.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the ensure-presence-multiple-records.yml Ansible playbook file. For example:

   $ cp ensure-presence-multiple-records.yml ensure-presence-multiple-records-copy.yml

4. Open the ensure-presence-multiple-records-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsrecord task section:

   • Set the ipaadmin_password variable to your IdM administrator password.
   • In the records section, set the name variable to host1.
   • In the records section, set the zone_name variable to idm.example.com.
   • In the records section, set the a_rec variable to 192.168.122.112 and to 192.168.122.122.

   • Define a second record in the records section:

     • Set the name variable to host1.
     • Set the zone_name variable to idm.example.com.
     • Set the aaaa_rec variable to ::1.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Test multiple DNS Records are present.
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     # Ensure that multiple dns records are present
     - ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         records:
           - name: host1
             zone_name: idm.example.com
             a_rec: 192.168.122.112
             a_rec: 192.168.122.122
           - name: host1
             zone_name: idm.example.com
             aaaa_rec: ::1

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-records-copy.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the ensure-CNAME-record-is-present.yml Ansible playbook file. For example:

   $ cp ensure-CNAME-record-is-present.yml ensure-CNAME-record-is-present-copy.yml

4. Open the ensure-CNAME-record-is-present-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsrecord task section:

   • Optional: Adapt the description provided by the name of the play.
   • Set the ipaadmin_password variable to your IdM administrator password.
   • Set the zone_name variable to idm.example.com.

   • In the records variable section, set the following variables and values:

     • Set the name variable to www.
     • Set the cname_hostname variable to host03.
     • Set the name variable to ftp.
     • Set the cname_hostname variable to host03.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure that 'www.idm.example.com' and 'ftp.idm.example.com' CNAME records point to 'host03.idm.example.com'.
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     - ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: idm.example.com
         records:
         - name: www
           cname_hostname: host03
         - name: ftp
           cname_hostname: host03

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-CNAME-record-is-present.yml

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

3. Make a copy of the ensure-SRV-record-is-present.yml Ansible playbook file. For example:

   $ cp ensure-SRV-record-is-present.yml ensure-SRV-record-is-present-copy.yml

4. Open the ensure-SRV-record-is-present-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsrecord task section:

   • Set the ipaadmin_password variable to your IdM administrator password.
   • Set the name variable to _kerberos._udp.idm.example.com.
   • Set the srv_rec variable to '10 50 88 idm.example.com'.

   • Set the zone_name variable to idm.example.com.

     This the modified Ansible playbook file for the current example:

   ---
   - name: Test multiple DNS Records are present.
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     # Ensure a SRV record is present
     - ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: _kerberos._udp.idm.example.com
         srv_rec: ’10 50 88 idm.example.com’
         zone_name: idm.example.com
         state: present

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-SRV-record-is-present.yml

Procedure

1. Authenticate to IdM as the admin user:

   $ kinit admin

2. Add the alias to the host principal. For example, to add the demo alias to the demo.examle.com host principal:

   $ ipa host-add-principal demo.example.com --principal=demo

Procedure

1. Set the dns_canonicalize_hostname parameter in the [libdefaults] section in the /etc/krb5.conf file to false:

   [libdefaults]
   ...
   dns_canonicalize_hostname = true