Skip to content

Latest commit

 

History

History
150 lines (123 loc) · 5.27 KB

proc_configuring-dynamic-dns-update-with-tsig-authentication.adoc

File metadata and controls

150 lines (123 loc) · 5.27 KB

Configuring Dynamic DNS Update with TSIG Authentication

You can configure an IdM server to use the secret key transaction authentication for DNS (TSIG) technology that uses the rndc.key key file for authentication. The TSIG protocol is defined in RFC2845.

Prerequisites

  • You must ensure the IdM server is deployed and the host-based firewall is configured correctly. For more information, see Port Requirements in the Linux Domain Identity, Authentication, and Policy Guide.

  • You must obtain root user access on the IdM server.

  • You must confirm whether {ProjectServer} or {SmartProxyServer} is configured to provide DNS service for your deployment.

  • You must configure DNS, DHCP and TFTP services on the base operating system of either the {Project} or {SmartProxy} that is managing the DNS service for your deployment.

  • You must create a backup of the answer file. You can use the backup to restore the answer file to its original state if it becomes corrupted. For more information, see {InstallingServerDocURL}configuring-server_{project-context}[Configuring {ProjectServer}].

Procedure

To configure dynamic DNS update with TSIG authentication, complete the following steps:

Enabling External Updates to the DNS Zone in the IdM Server

  1. On the IdM Server, add the following to the top of the /etc/named.conf file:

    ########################################################################

include "/etc/rndc.key";
controls  {
inet _IdM_Server_IP_Address_ port 953 allow { _{Project}_IP_Address_; } keys { "rndc-key"; };
};
########################################################################

  2. Reload the named service to make the changes take effect:

    # systemctl reload named

  3. In the IdM web UI, navigate to Network Services > DNS > DNS Zones and click the name of the zone. In the Settings tab, apply the following changes:

    1. Add the following in the BIND update policy box:

      grant "rndc-key" zonesub ANY;

    2. Set Dynamic update to True.

    3. Click Update to save the changes.

  4. Copy the /etc/rndc.key file from the IdM server to the base operating system of your {ProjectServer}. Enter the following command:

    # scp /etc/rndc.key root@{foreman-example-com}:/etc/rndc.key

  5. To set the correct ownership, permissions, and SELinux context for the rndc.key file, enter the following command:

    # restorecon -v /etc/rndc.key
# chown -v root:named /etc/rndc.key
# chmod -v 640 /etc/rndc.key

  6. Assign the foreman-proxy user to the named group manually. Normally, {foreman-installer} ensures that the foreman-proxy user belongs to the named UNIX group, however, in this scenario {Project} does not manage users and groups, therefore you need to assign the foreman-proxy user to the named group manually.

    # usermod -a -G named foreman-proxy

  7. On {ProjectServer}, enter the following {foreman-installer} command to configure {Project} to use the external DNS server:

    # {installer-scenario} \
--foreman-proxy-dns=true \
--foreman-proxy-dns-managed=false \
--foreman-proxy-dns-provider=nsupdate \
--foreman-proxy-dns-server="IdM_Server_IP_Address" \
--foreman-proxy-keyfile=/etc/rndc.key \
--foreman-proxy-dns-ttl=86400
Testing External Updates to the DNS Zone in the IdM Server

  1. Ensure that the key in the /etc/rndc.key file on {ProjectServer} is the same key file that is used on the IdM server:

    key "rndc-key" {
        algorithm hmac-md5;
        secret "secret-key==";
};

  2. On {ProjectServer}, create a test DNS entry for a host. For example, host test.example.com with an A record of 192.168.25.20 on the IdM server at 192.168.25.1.

    # echo -e "server 192.168.25.1\n \
update add test.example.com 3600 IN A 192.168.25.20\n \
send\n" | nsupdate -k /etc/rndc.key

  3. On {ProjectServer}, test the DNS entry:

    # nslookup test.example.com 192.168.25.1
Server:		192.168.25.1
Address:	192.168.25.1#53

Name:	test.example.com
Address: 192.168.25.20

  4. To view the entry in the IdM web UI, navigate to Network Services > DNS > DNS Zones. Click the name of the zone and search for the host by name.

  5. If resolved successfully, remove the test DNS entry:

    # echo -e "server 192.168.25.1\n \
update delete test.example.com 3600 IN A 192.168.25.20\n \
send\n" | nsupdate -k /etc/rndc.key

  6. Confirm that the DNS entry was removed:

    # nslookup test.example.com 192.168.25.1

    The above nslookup command fails and returns the SERVFAIL error message if the record was successfully deleted.