Chapter 29. Securing DNS with DoT in IdM

Procedure

1. Add the dns-over-tls service to the system firewall to open port 853/TCP for DoT traffic:

   # firewall-cmd --add-service=dns-over-tls

   Copy to Clipboard Toggle word wrap

2. Optional: To use a custom PEM-formatted certificate and key for DoT issued by an external certificate authority, create the files:

   $ openssl req \
     -newkey rsa:2048 \
     -nodes \
     -keyout /etc/pki/tls/certs/privkey.pem \
     -x509 \
     -days 36500 \
     -out /etc/pki/tls/certs/certificate.pem \
     -subj "/C=<country_code>/ST=<state>/L=<location>/O=<organization>/OU=<organizational_unit>/CN=<idm_server_fqdn>/emailAddress=<email>" && \
     chown named:named /etc/pki/tls/certs/privkey.pem /etc/pki/tls/certs/certificate.pem

   Copy to Clipboard Toggle word wrap
3. Install the IdM server with integrated DNS:

Troubleshooting

1. Enable detailed logging for the unbound service:

   # unbound-control verbosity 3

   Copy to Clipboard Toggle word wrap

2. Restart the unbound service to apply the updated configuration:

   # systemctl restart unbound

   Copy to Clipboard Toggle word wrap

3. Monitor real-time logs of the unbound service:

   $ journalctl -u unbound -f

   Copy to Clipboard Toggle word wrap

Procedure

1. Copy the IdM server’s DoT certificate to the client and replica system.

   $ scp /etc/pki/tls/certs/bind_dot.crt <username>@<ip>:/etc/pki/ca-trust/source/anchors/

   Copy to Clipboard Toggle word wrap

2. Update the system-wide trust store configuration:

   # update-ca-trust extract

   Copy to Clipboard Toggle word wrap

3. On the client and replica system, install the dnsconfd package:

   # dnf install dnsconfd

   Copy to Clipboard Toggle word wrap

4. Generate the default configuration files for DoT on your system:

   dnsconfd config install

   Copy to Clipboard Toggle word wrap

5. Enable the dnsconfd service:

   # systemctl enable --now dnsconfd

   Copy to Clipboard Toggle word wrap

6. Reload NetworkManager to apply the configuration:

   # nmcli g reload

   Copy to Clipboard Toggle word wrap

7. Configure the system’s DNS settings in NetworkManager.

   # nmcli device modify <device_name> ipv4.dns dns+tls://<idm_server_ip>
   
   Connection successfully reapplied to device '<device_name>'.

   Copy to Clipboard Toggle word wrap

Verification

1. On the IdM client, review cat /etc/unbound/unbound.conf:

   $ cat /etc/unbound/unbound.conf

   Copy to Clipboard Toggle word wrap
2. Verify that the configuration contains the IP address and hostname of the IdM server.

Troubleshooting

1. On the IdM client, run a DNS query to trigger traffic:

   $ dig <domain_name>

   Copy to Clipboard Toggle word wrap
2. Review the logs on the IdM server to verify that the query was routed through DoT.

Procedure

1. Add the dns-over-tls service to the system firewall to open port 853/TCP for DoT traffic:

   # firewall-cmd --add-service=dns-over-tls

   Copy to Clipboard Toggle word wrap

2. Depending on whether you want the replica to manage DNS records, choose one of the following:

   • To install an IdM replica with integrated DNS:

     # ipa-replica-install --setup-dns --dns-over-tls --dot-forwarder <server_ip>#<dns_server_hostname>

     Copy to Clipboard Toggle word wrap

   • To install an IdM replica without integrated DNS:

     # ipa-replica-install --dns-over-tls

     Copy to Clipboard Toggle word wrap

Procedure

1. Optional: Verify that your IdM server uses integrated DNS:

   $ ipa server-role-find --role 'DNS server'
   ---------------------
   1 server role matched
   ---------------------
     Server name: server.idm.example.com
     Role name: DNS server
     Role status: enabled
   ----------------------------
   Number of entries returned 1
   ----------------------------

   Copy to Clipboard Toggle word wrap

2. Install the ipa-server-encrypted-dns package on your IdM server:

   # dnf install ipa-server-encrypted-dns

   Copy to Clipboard Toggle word wrap

3. Update the integrated DNS service to enable DoT and configure DoT policy and forwarders:

   # ipa-dns-install --dns-over-tls --dot-forwarder "<server_ip>#<dns_server_hostname>" --dns-policy enforced -U

   Copy to Clipboard Toggle word wrap

   For a complete list of options see the ipa-dns-install(1) man page on your system.

4. Add the dns-over-tls service to the system firewall to open port 853/TCP for DoT traffic:

   # firewall-cmd --add-service=dns-over-tls

   Copy to Clipboard Toggle word wrap

Procedure

1. Optional: To use a custom PEM-formatted certificate and key for DoT issued by an external certificate authority:

   1. SSH to the host where you are going to install the IdM server:

      $ ssh root@server.idm.example.com

      Copy to Clipboard Toggle word wrap

   2. Create the two files and assign ownership to the named daemon:

      # openssl req \
      -newkey rsa:2048 \
      -nodes \
      -keyout /etc/pki/tls/certs/privkey.pem \
      -x509 \
      -days 36500 \
      -out /etc/pki/tls/certs/certificate.pem \
      -subj "/C=<country_code>/ST=<state>/L=<location>/O=<organization>/OU=<organizational_unit>/CN=<idm_server_fqdn>/emailAddress=<email>" && \
      chown named:named /etc/pki/tls/certs/privkey.pem /etc/pki/tls/certs/certificate.pem

      Copy to Clipboard Toggle word wrap

   3. Exit the SSH session on the IdM server:

      # exit

      Copy to Clipboard Toggle word wrap

2. On the Ansible controller, create a playbook file named install-server-integrated-ca.yml with the instructions to install an IdM server with an integrated IdM CA:

   ---
   - name: Playbook to configure IPA server
     hosts: ipaserver
     become: true
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     vars:
       ipaserver_domain: idm.example.com
       ipaserver_realm: IDM.EXAMPLE.COM
       ipaserver_hostname: server.idm.example.com
       ipa_admin_password: "{{ vault_admin_password }}"
       ipadm_password: "{{ vault_dm_password }}"
       ipaserver_setup_dns: true
       ipaserver_dot_forwarders:
       - "<server_ip>#<dns_server_hostname>"
       ipaserver_dns_over_tls: true
       ipaserver_auto_reverse: true
   
     roles:
     - role: ipaserver

   Copy to Clipboard Toggle word wrap

   If you are using a custom PEM-formatted certificate and key for DoT issued by an external certificate authority, add the following in the vars section:

   ipaserver_dns_over_tls_cert: /etc/pki/tls/certs/certificate.pem
   ipaserver_dns_over_tls_key: /etc/pki/tls/certs/privkey.pem

   Copy to Clipboard Toggle word wrap

3. Run the Ansible playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-integrated-ca.yml

   Copy to Clipboard Toggle word wrap

Troubleshooting

1. SSH to the IdM server:

   # ssh root@server.idm.example.com

   Copy to Clipboard Toggle word wrap

2. Enable detailed logging for the unbound service:

   # unbound-control verbosity 3

   Copy to Clipboard Toggle word wrap

3. Restart the unbound service to apply the updated configuration:

   # systemctl restart unbound

   Copy to Clipboard Toggle word wrap

4. Monitor real-time logs of the unbound service:

   $ journalctl -u unbound -f

   Copy to Clipboard Toggle word wrap

Procedure

1. Optional: To use a custom PEM-formatted certificate and key for DoT issued by an external certificate authority:

   1. SSH to the host where you are going to install the IdM server:

      $ ssh root@server.idm.example.com

      Copy to Clipboard Toggle word wrap

   2. Create the two files and assign ownership to the named daemon:

      # openssl req \
      -newkey rsa:2048 \
      -nodes \
      -keyout /etc/pki/tls/certs/privkey.pem \
      -x509 \
      -days 36500 \
      -out /etc/pki/tls/certs/certificate.pem \
      -subj "/C=<country_code>/ST=<state>/L=<location>/O=<organization>/OU=<organizational_unit>/CN=<idm_server_fqdn>/emailAddress=<email>" && \
      chown named:named /etc/pki/tls/certs/privkey.pem /etc/pki/tls/certs/certificate.pem

      Copy to Clipboard Toggle word wrap

   3. Exit the SSH session on the IdM server:

      # exit

      Copy to Clipboard Toggle word wrap

2. On the Ansible controller, create a playbook file named install-server-external-ca-step1.yml with the instructions to install an IdM server with an external CA:

   ---
   - name: Playbook to configure IPA server Step 1: generate CSR for IdM external CA setup
     hosts: ipaserver
     become: true
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     vars:
       ipaserver_domain: idm.example.com
       ipaserver_realm: IDM.EXAMPLE.COM
       ipaserver_hostname: server.idm.example.com
       ipaadmin_password: "{{ vault_admin_password }}"
       ipadm_password: "{{ vault_dm_password }}"
       ipaserver_setup_dns: true
       ipaserver_dot_forwarders:
       - "<server_ip>#<dns_server_hostname>"
       ipaserver_external_ca: true
       ipaserver_dns_over_tls: true
       ipaserver_no_dnssec_validation: true
       ipaserver_auto_reverse: true
   
     roles:
     - role: ipaserver
   
     post_tasks:
     - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}"
       fetch:
         src: /root/ipa.csr
         dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}"
         flat: true

   Copy to Clipboard Toggle word wrap

   If you are using a custom PEM-formatted certificate and key for DoT issued by an external certificate authority, add the following in the vars section:

   ipaserver_dns_over_tls_cert: /etc/pki/tls/certs/certificate.pem
   ipaserver_dns_over_tls_key: /etc/pki/tls/certs/privkey.pem

   Copy to Clipboard Toggle word wrap

3. Run the Ansible playbook with the instructions for the first step of the installation:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-external-ca-step1.yml

   Copy to Clipboard Toggle word wrap
4. Locate the ipa.csr certificate signing request file on the controller and submit it to the external CA.
5. Place the IdM CA certificate signed by the external CA and the CA certificate chain in the controller file system so that the playbook in the next step can find it.

6. Create a new Ansible playbook, for example install-server-external-ca-step2.yml, for the second step of IdM server installation with the following content:

   ---
   - name: Playbook to configure IdM server Step 2: import certificates and finalize installation
     hosts: ipaserver
     become: true
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     vars:
       ipaserver_domain: idm.example.com
       ipaserver_realm: IDM.EXAMPLE.COM
       ipaserver_hostname: server.idm.example.com
       ipaadmin_password: "{{ vault_admin_password }}"
       ipadm_password: "{{ vault_dm_password }}"
       ipaserver_setup_dns: true
       ipaserver_dot_forwarders:
       - "<server_ip>#<dns_server_hostname>"
       ipaserver_external_ca: true
       ipaserver_dns_over_tls: true
       ipaserver_no_dnssec_validation: true
       ipaserver_auto_reverse: true
       ipaserver_external_cert_files:
       - servercert20240601.pem
       - cacert.pem
   
     pre_tasks:
     - name: Copy "{{ groups.ipaserver[0] }}-{{ item }}" to "/root/{{ item }}" on node
       ansible.builtin.copy:
         src: "{{ groups.ipaserver[0] }}-{{ item }}"
         dest: "/root/{{ item }}"
         force: true
       with_items:
       - servercert20240601.pem
       - cacert.pem
   
     roles:
     - role: ipaserver
       state: present

   Copy to Clipboard Toggle word wrap

7. Run the Ansible playbook with the instructions for the final step of the installation:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-external-ca-step2.yml

   Copy to Clipboard Toggle word wrap

Troubleshooting

1. SSH to the IdM server:

   # ssh root@server.idm.example.com

   Copy to Clipboard Toggle word wrap

2. Enable detailed logging for the unbound service:

   # unbound-control verbosity 3

   Copy to Clipboard Toggle word wrap

3. Restart the unbound service to apply the updated configuration:

   # systemctl restart unbound

   Copy to Clipboard Toggle word wrap

4. Monitor real-time logs of the unbound service:

   $ journalctl -u unbound -f

   Copy to Clipboard Toggle word wrap

Procedure

1. On the controller, create a playbook named install-client-edns.yml that includes a task to install an IdM client with eDNS enabled:

   ---
   - name: Playbook to configure an IdM client with eDNS enabled
     hosts: ipaclients
     become: true
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipaclient_domain=idm.example.com
       ipaclient_dns_over_tls=true
   
     roles:
     - role: ipaclient

   Copy to Clipboard Toggle word wrap

   If DNSSEC validation is turned off on the IdM server that the client is communicating with, you must also disable it on the client by setting ipaclient_no_dnssec_validation = true in the vars section of the playbook. Otherwise, DNS over TLS will not function correctly for the client.

2. Run the Ansible playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-client-edns.yml

   Copy to Clipboard Toggle word wrap

Verification

1. On the IdM client, review /etc/unbound/unbound.conf:

   $ cat /etc/unbound/unbound.conf

   Copy to Clipboard Toggle word wrap
2. Verify that the configuration contains the IP address and host name of the IdM server.

Troubleshooting

1. On the IdM client, run a DNS query to trigger traffic:

   $ dig <domain_name>

   Copy to Clipboard Toggle word wrap
2. Review the logs on the IdM server to verify that the query was routed through DoT.

Procedure

1. On the controller, create a playbook named install-replica-edns.yml that includes a task to install an IdM replica with eDNS enabled:

   ---
   - name: Playbook to configure an IdM replica with eDNS enabled
     hosts: ipareplicas
     become: true
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipareplica_domain=idm.example.com
       ipareplica_dns_over_tls=true
   
     roles:
     - role: ipareplica

   Copy to Clipboard Toggle word wrap

   If DNSSEC validation is turned off on the IdM server that the replica is communicating with, you must also disable it on the replica by setting ipaclient_no_dnssec_validation = true in the vars section of the playbook. Otherwise, DNS over TLS will not function correctly for the replica.

   To install integrated IdM DNS on the IdM replica, add ipareplica_setup_dns=true and ipareplica_dot_forwarders="<server_ip>#<dns_server_hostname>" to the list of variables.

2. Run the Ansible playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-replica-edns.yml

   Copy to Clipboard Toggle word wrap