Working with DNS in Identity Management

1. The DNS installation script creates an /etc/NetworkManager/conf.d/zzz-ipa.conf NetworkManager configuration file to control the search order and DNS server list:

   # auto-generated by IPA installer
   [main]
   dns=default
   
   [global-dns]
   searches=$DOMAIN
   
   [global-dns-domain-*]
   servers=127.0.0.1

   Copy to Clipboard Toggle word wrap
2. The NetworkManager service is reloaded, which always creates the /etc/resolv.conf file with the settings from the last file in the /etc/NetworkManager/conf.d/ directory. This is in this case the zzz-ipa.conf file.

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap
4. Open the ensure-presence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 7.7.9.9.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:db8::1:0.
      3. Verify the port value is set to 53.

   4. Change the state to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 7.7.9.9
           - ip_address: 2001:db8::1:0
             port: 53
         state: present

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap
4. Open the ensure-absence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.
   4. Set the action variable to member.
   5. Verify the state is set to absent.

   This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         action: member
         state: absent

   Copy to Clipboard Toggle word wrap
   Important

   If you only use the state: absent option in your playbook without also using action: member, the playbook fails.

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the set-configuration.yml Ansible playbook file. For example:

   $ cp set-configuration.yml set-forward-policy-to-first.yml

   Copy to Clipboard Toggle word wrap
4. Open the set-forward-policy-to-first.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsconfig task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the forward_policy variable to first.

     Delete all the other lines of the original playbook that are irrelevant. This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to set global forwarding policy to first
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Set global forwarding policy to first.
       ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         forward_policy: first

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file set-forward-policy-to-first.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the disable-global-forwarders.yml Ansible playbook file. For example:

   $ cp disable-global-forwarders.yml disable-global-forwarders-copy.yml

   Copy to Clipboard Toggle word wrap
4. Open the disable-global-forwarders-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsconfig task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the forward_policy variable to none.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to disable global DNS forwarders
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Disable global forwarders.
       ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         forward_policy: none

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the disallow-reverse-sync.yml Ansible playbook file. For example:

   $ cp disallow-reverse-sync.yml disallow-reverse-sync-copy.yml

   Copy to Clipboard Toggle word wrap
4. Open the disallow-reverse-sync-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnsconfig task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the allow_sync_ptr variable to no.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to disallow reverse record synchronization
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Disallow reverse record synchronization.
       ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         allow_sync_ptr: no

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disallow-reverse-sync-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

   Figure 2.1. Managing IdM DNS primary zones

   

   View larger image

   
2. Click Add at the top of the list of all zones.

3. Provide the zone name.

   Figure 2.2. Entering an new IdM primary zone

   

   View larger image

   
4. Click Add.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

2. Select the check box by the zone name and click Delete.

   Figure 2.3. Removing a primary DNS Zone

   

   View larger image

   
3. In the Remove DNS zones dialog window, confirm that you want to delete the selected zone.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

   Figure 2.4. DNS primary zones management

   

   View larger image

   

2. In the DNS Zones section, click on the zone name in the list of all zones to open the DNS zone page.

   Figure 2.5. Editing a primary zone

   

   View larger image

   

3. Click Settings.

   Figure 2.6. The Settings tab in the primary zone edit page

   

   View larger image

   

4. Change the zone configuration as required.

   For information about the available settings, see IdM DNS zone attributes.

5. Click Save to confirm the new configuration.

   Note

   If you are changing the default time to live (TTL) of a zone, restart the named service on all IdM DNS servers to make the changes take effect. All other settings are automatically activated immediately.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click Settings.

3. Under Allow transfer, specify the name servers to which you want to transfer the zone records.

   Figure 2.7. Enabling zone transfers

   

   View larger image

   
4. Click Save at the top of the DNS zone page to confirm the new configuration.

Verification

1. SSH to one of the DNS servers to which zone transfer has been enabled:

   $ ssh 192.0.2.1

   Copy to Clipboard Toggle word wrap

2. Transfer the IdM DNS zone using a tool such as the dig utility:

   # dig @ipa-server zone_name AXFR

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnszone directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the dnszone-present.yml Ansible playbook file. For example:

   $ cp dnszone-present.yml dnszone-present-copy.yml

   Copy to Clipboard Toggle word wrap
4. Open the dnszone-present-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnszone task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the zone_name variable to zone.idm.example.com.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         state: present

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-present-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnszone directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the dnszone-all-params.yml Ansible playbook file. For example:

   $ cp dnszone-all-params.yml dnszone-all-params-copy.yml

   Copy to Clipboard Toggle word wrap
4. Open the dnszone-all-params-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnszone task section:

   • Set the ipaadmin_password variable to your IdM administrator password.
   • Set the zone_name variable to zone.idm.example.com.
   • Set the allow_sync_ptr variable to true if you want to allow the synchronization of forward and reverse records, that is the synchronization of A and AAAA records with PTR records.
   • Set the dynamic_update variable to true to enable IdM client machines to add or update their IP addresses.

   • Set the dnssec variable to true to allow inline DNSSEC signing of records in the zone.

     Warning

     DNSSEC is only available as Technology Preview in IdM.

   • Set the allow_transfer variable to the IP addresses of secondary name servers in the zone.
   • Set the allow_query variable to the IP addresses or networks that are allowed to issue queries.
   • Set the forwarders variable to the IP addresses of global forwarders.
   • Set the serial variable to the SOA record serial number.
   • Define the refresh, retry, expire, minimum, ttl, and default_ttl values for DNS records in the zone.
   • Define the NSEC3PARAM record for the zone using the nsec3param_rec variable.
   • Set the skip_overlap_check variable to true to force DNS creation even if it overlaps with an existing zone.

   • Set the skip_nameserver_check to true to force DNS zone creation even if the nameserver is not resolvable.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         allow_sync_ptr: true
         dynamic_update: true
         dnssec: true
         allow_transfer:
           - 1.1.1.1
           - 2.2.2.2
         allow_query:
           - 1.1.1.1
           - 2.2.2.2
         forwarders:
           - ip_address: 8.8.8.8
           - ip_address: 8.8.4.4
             port: 52
         serial: 1234
         refresh: 3600
         retry: 900
         expire: 1209600
         minimum: 3600
         ttl: 60
         default_ttl: 90
         name_server: server.idm.example.com.
         admin_email: admin.admin@idm.example.com
         nsec3param_rec: "1 7 100 0123456789abcdef"
         skip_overlap_check: true
         skip_nameserver_check: true
         state: present

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-all-params-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnszone directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the dnszone-reverse-from-ip.yml Ansible playbook file. For example:

   $ cp dnszone-reverse-from-ip.yml dnszone-reverse-from-ip-copy.yml

   Copy to Clipboard Toggle word wrap
4. Open the dnszone-reverse-from-ip-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnszone task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the name_from_ip variable to the IP of your IdM nameserver, and provide its prefix length.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Ensure dnszone present
       hosts: ipaserver
       become: true
     
       tasks:
       - name: Ensure zone for reverse DNS lookup is present.
         ipadnszone:
           ipaadmin_password: "{{ ipaadmin_password }}"
           name_from_ip: 192.168.1.2/24
           state: present
         register: result
       - name: Display inferred zone name.
         debug:
           msg: "Zone name: {{ result.dnszone.name }}"

     Copy to Clipboard Toggle word wrap

   The playbook creates a zone for reverse DNS lookup from the 192.168.1.2 IP address and its prefix length of 24. Next, the playbook displays the resulting zone name.

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-reverse-from-ip-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the IPA Server tab.
2. Select Topology subtab.
3. Click IPA Locations in the navigation bar.
4. Click Add at the top of the locations list.
5. Fill in the location name.
6. Click the Add button to save the location.
7. Optional: Repeat the steps to add further locations.

Procedure

1. For example, to create a new location germany, enter:

   $ ipa location-add germany
   ----------------------------
   Added IPA location "germany"
   ----------------------------
     Location name: germany

   Copy to Clipboard Toggle word wrap
2. Optional: Repeat the step to add further locations.

Procedure

1. Open the IPA Server tab.
2. Select the Topology subtab.
3. Click IPA Servers in the navigation.
4. Click on the IdM server name.

5. Select a DNS location, and optionally set a service weight:

   Figure 4.1. Assigning a server to a DNS location

   

   View larger image

   
6. Click Save.

7. On the command line (CLI) of the host you assigned in the previous steps the DNS location to, restart the named service:

   [root@idmserver-01 ~]# systemctl restart named

   Copy to Clipboard Toggle word wrap
8. Optional: Repeat the steps to assign DNS locations to further IdM servers.

Procedure

1. Optional: List all configured DNS locations:

   [root@server ~]# ipa location-find
   -----------------------
   2 IPA locations matched
   -----------------------
   Location name: australia
   Location name: germany
   -----------------------------
   Number of entries returned: 2
   -----------------------------

   Copy to Clipboard Toggle word wrap

2. Assign the server to the DNS location. For example, to assign the location germany to the server idmserver-01.idm.example.com, run:

   # ipa server-mod idmserver-01.idm.example.com --location=germany
   [...]
   --------------------------------------------------
   Modified IPA server "idmserver-01.idm.example.com"
   --------------------------------------------------
   Servername: idmserver-01.idm.example.com
   Min domain level: 0
   Max domain level: 1
   Location: germany
   Enabled server roles: DNS server, NTP server

   Copy to Clipboard Toggle word wrap

3. Restart the named service on the host you assigned in the previous steps the DNS location to:

   # systemctl restart named

   Copy to Clipboard Toggle word wrap
4. Optional: Repeat the steps to assign DNS locations to further IdM servers.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the location-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/location/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/location/location-present.yml location-present-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the location-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipalocation task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the location.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: location present example
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure that the "germany" location is present
       ipalocation:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: germany

   Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory location-present-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the location-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/location/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/location/location-absent.yml location-absent-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the location-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipalocation task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the DNS location.
   • Make sure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: location absent example
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure that the "germany" location is absent
       ipalocation:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: germany
         state: absent

   Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory location-absent-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM Web UI, select Network Services → DNS Global Configuration → DNS.

   

   View larger image

   

2. In the DNS Global Configuration section, click Add.

   

   View larger image

   

3. Specify the IP address of the DNS server that will receive forwarded DNS queries.

   

   View larger image

   

4. Select the Forward policy.

   

   View larger image

   
5. Click Save at the top of the window.

Verification

1. Select Network Services → DNS Global Configuration → DNS.

   

   View larger image

   

2. Verify that the global forwarder, with the forward policy you specified, is present and enabled in the IdM Web UI.

   

   View larger image

   

Procedure

1. In the IdM Web UI, select Network Services → DNS Forward Zones → DNS.

   

   View larger image

   

2. In the DNS Forward Zones section, click Add.

   

   View larger image

   

3. In the Add DNS forward zone window, specify the forward zone name.

   

   View larger image

   

4. Click the Add button and specify the IP address of a DNS server to receive the forwarding request. You can specify multiple forwarders per forward zone.

   

   View larger image

   

5. Select the Forward policy.

   

   View larger image

   
6. Click Add at the bottom of the window to add the new forward zone.

Verification

1. In the IdM Web UI, select Network Services → DNS Forward Zones → DNS.

   

   View larger image

   

2. Verify that the forward zone you created, with the forwarders and forward policy you specified, is present and enabled in the IdM Web UI.

   

   View larger image

   

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the set-configuration.yml Ansible playbook file. For example:

   $ cp set-configuration.yml establish-global-forwarder.yml

   Copy to Clipboard Toggle word wrap
4. Open the establish-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to establish a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.

   4. Change the forward_policy to first.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to establish a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800
       ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         forward_policy: first
         allow_sync_ptr: true

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file establish-global-forwarder.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap
4. Open the ensure-presence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 7.7.9.9.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:db8::1:0.
      3. Verify the port value is set to 53.

   4. Change the state to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 7.7.9.9
           - ip_address: 2001:db8::1:0
             port: 53
         state: present

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap
4. Open the ensure-absence-of-a-global-forwarder.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53.

   3. In the forwarders section of the ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.
   4. Set the action variable to member.
   5. Verify the state is set to absent.

   This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53
       ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         action: member
         state: absent

   Copy to Clipboard Toggle word wrap
   Important

   If you only use the state: absent option in your playbook without also using action: member, the playbook fails.

6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Verify the contents of the disable-global-forwarders.yml Ansible playbook file which is already configured to disable all DNS global forwarders. For example:

   $ cat disable-global-forwarders.yml
   ---
   - name: Playbook to disable global DNS forwarders
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Disable global forwarders.
       ipadnsconfig:
         forward_policy: none

   Copy to Clipboard Toggle word wrap

4. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-forwardzone.yml

   Copy to Clipboard Toggle word wrap
4. Open the ensure-presence-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure presence of a dnsforwardzone for example.com to 8.8.8.8.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.

      3. In the forwarders section:

         1. Remove the ip_address and port lines.

         2. Add the IP address of the DNS server to receive forwarded requests by specifying it after a dash:

            - 8.8.8.8

            Copy to Clipboard Toggle word wrap
      4. Add the forwardpolicy variable and set it to first.
      5. Add the skip_overlap_check variable and set it to true.
      6. Change the state variable to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a dnsforwardzone for example.com to 8.8.8.8
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: example.com
         forwarders:
             - 8.8.8.8
         forwardpolicy: first
         skip_overlap_check: true
         state: present

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-forwardzone.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-multiple-forwarders.yml

   Copy to Clipboard Toggle word wrap
4. Open the ensure-presence-multiple-forwarders.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.

      3. In the forwarders section:

         1. Remove the ip_address and port lines.

         2. Add the IP address of the DNS servers you want to ensure are present, preceded by a dash:

            - 8.8.8.8
            - 4.4.4.4

            Copy to Clipboard Toggle word wrap
      4. Change the state variable to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: name: Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
        name: example.com
         forwarders:
             - 8.8.8.8
             - 4.4.4.4
         state: present

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-forwarders.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-disabled-forwardzone.yml

   Copy to Clipboard Toggle word wrap
4. Open the ensure-disabled-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure a dnsforwardzone is disabled in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure a dnsforwardzone for example.com is disabled.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.
      3. Remove the entire forwarders section.
      4. Change the state variable to disabled.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure a dnsforwardzone is disabled in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure a dnsforwardzone for example.com is disabled
     ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: example.com
         state: disabled

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-disabled-forwardzone.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-forwardzone.yml

   Copy to Clipboard Toggle word wrap
4. Open the ensure-absence-forwardzone.yml file for editing.

5. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a dnsforwardzone for example.com.
   3. In the tasks section, change the ipadnsconfig heading to ipadnsforwardzone.

   4. In the ipadnsforwardzone section:

      1. Add the ipaadmin_password variable and set it to your IdM administrator password.
      2. Add the name variable and set it to example.com.
      3. Remove the entire forwarders section.
      4. Leave the state variable as absent.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a dnsforwardzone for example.com
       ipadnsforwardzone:
          ipaadmin_password: "{{ ipaadmin_password }}"
          name: example.com
          state: absent

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-forwardzone.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the DNS zone to which you want to add a DNS record.

3. In the DNS Resource Records section, click Add to add a new record.

   Figure 7.1. Adding a New DNS Resource Record

   

   View larger image

   

4. Select the type of record to create and fill out the other fields as required.

   Figure 7.2. Defining a New DNS Resource Record

   

   View larger image

   
5. Click Add to confirm the new record.

Procedure

1. To add a DNS resource record, use the ipa dnsrecord-add command. The command follows this syntax:

   $ ipa dnsrecord-add zone_name record_name --record_type_option=data

   Copy to Clipboard Toggle word wrap

   In the command above:

   • The zone_name is the name of the DNS zone to which the record is being added.
   • The record_name is an identifier for the new DNS resource record.

   For example, to add an A type DNS record of host1 to the idm.example.com zone, enter:

   $ ipa dnsrecord-add idm.example.com host1 --a-rec=192.168.122.123

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the zone from which you want to delete a DNS record, for example example.com..

3. In the DNS Resource Records section, click the name of the resource record.

   Figure 7.3. Selecting a DNS Resource Record

   

   View larger image

   
4. Select the check box by the name of the record type to delete.

5. Click Delete.

   Figure 7.4. Deleting a DNS Resource Record

   

   View larger image

   

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the zone from which you want to delete a DNS record, for example zone.example.com..
3. In the DNS Resource Records section, select the check box of the resource record to delete.

4. Click Delete.

   Figure 7.5. Deleting an Entire Resource Record

   

   View larger image