Chapter 12. TLS-e for DCN

Procedure

• If you are running Red Hat Enterprise Linux (RHEL) 8.2, you must upgrade RHEL to version 8.4, and then follow the directions for RHEL 8.4

• If you are running RHEL 8.4, modify the ipa-ext.conf and ipa-options-ext.conf files:

  1. Add trusted subnets to the access control list (ACL) in the ipa-ext.conf file:

      acl "trusted_network" {
        localnets;
        localhost;
        192.168.24.0/24;
        192.168.25.0/24;
      };

     Copy to Clipboard Toggle word wrap

  2. Allow recursion and query cache in the /etc/named/ipa-options-ext.conf file:

     allow-recursion { trusted_network; };
     allow-query-cache { trusted_network; };

     Copy to Clipboard Toggle word wrap

  3. Restart the `named-pkcs11 service:

     systemctl restart named-pkcs11

     Copy to Clipboard Toggle word wrap

• If you are running a version of RHEL 7, you must add an access control instruction for your domain manually.

  1. Run the following commands on Red Hat Identity Manager to configure the ACI.

     ADMIN_PASSWORD=<redhat_01>
     DOMAIN_LEVEL_1=<local>
     DOMAIN_LEVEL_2=<redhat>
     
     cat << EOF | ldapmodify -x -D "cn=Directory Manager" -w ${ADMIN_PASSWORD}
     dn: cn=dns,dc=${DOMAIN_LEVEL_2},dc=${DOMAIN_LEVEL_1}
     changetype: modify
     add: aci
     aci: (targetattr = "aaaarecord || arecord || cnamerecord || idnsname || objectclass || ptrrecord")(targetfilter = "(&(objectclass=idnsrecord)(|(aaaarecord=)(arecord=)(cnamerecord=)(ptrrecord=)(idnsZoneActive=TRUE)))")(version 3.0; acl "Allow hosts to read DNS A/AAA/CNAME/PTR records"; allow (read,search,compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,dc=${DOMAIN_LEVEL_2},dc=${DOMAIN_LEVEL_1}";)
     EOF

     Copy to Clipboard Toggle word wrap
• Replace <redhat_01> with the administrative password that you want to set.
• Replace <local> with the top-level domain.
• Replace <redhat> with the second-level domain.

Additional resources

• Implementing TLS-e with Ansible