Chapter 27. Managing global DNS configuration in IdM using Ansible playbooks Using the Red Hat Ansible Engine dnsconfig module, you can configure global configuration for Identity Management (IdM) DNS. Settings defined in global DNS configuration are applied to all IdM DNS servers. However, the global configuration has lower priority than the configuration for a specific IdM DNS zone. The dnsconfig module supports the following variables: The global forwarders, specifically their IP addresses and the port used for communication. The global forwarding policy: only, first, or none. For more details on these types of DNS forward policies, see DNS forward policies in IdM . The synchronization of forward lookup and reverse lookup zones. Prerequisites DNS service is installed on the IdM server. For more information about how to install an IdM server with integrated DNS, see one of the following links: Installing an IdM server: With integrated DNS, with an integrated CA as the root CA Installing an IdM server: With integrated DNS, with an external CA as the root CA Installing an IdM server: With integrated DNS, without a CA This chapter includes the following sections: How IdM ensures that global forwarders from /etc/resolv.conf are not removed by NetworkManager Ensuring the presence of a DNS global forwarder in IdM using Ansible Ensuring the absence of a DNS global forwarder in IdM using Ansible The action: member option in ipadnsconfig ansible-freeipa modules An introduction to DNS forward policies in IdM Using an Ansible playbook to ensure that the forward first policy is set in IdM DNS global configuration Using an Ansible playbook to ensure that global forwarders are disabled in IdM DNS Using an Ansible playbook to ensure that synchronization of forward and reverse lookup zones is disabled in IdM DNS 27.1. How IdM ensures that global forwarders from /etc/resolv.conf are not removed by NetworkManager Installing Identity Management (IdM) with integrated DNS configures the /etc/resolv.conf file to point to the 127.0.0.1 localhost address: In certain environments, such as networks that use Dynamic Host Configuration Protocol (DHCP), the NetworkManager service may revert changes to the /etc/resolv.conf file. To make the DNS configuration persistent, the IdM DNS installation process also configures the NetworkManager service in the following way: The DNS installation script creates an /etc/NetworkManager/conf.d/zzz-ipa.conf NetworkManager configuration file to control the search order and DNS server list: The NetworkManager service is reloaded, which always creates the /etc/resolv.conf file with the settings from the last file in the /etc/NetworkManager/conf.d/ directory. This is in this case the zzz-ipa.conf file. Important Do not modify the /etc/resolv.conf file manually. 27.2. Ensuring the presence of a DNS global forwarder in IdM using Ansible Follow this procedure to use an Ansible playbook to ensure the presence of a DNS global forwarder in IdM. In the example procedure below, the IdM administrator ensures the presence of a DNS global forwarder to a DNS server with an Internet Protocol (IP) v4 address of 7.7.9.9 and IP v6 address of 2001:db8::1:0 on port 53 . Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You know the IdM administrator password. Procedure Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory: Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the forwarders-absent.yml Ansible playbook file. For example: Open the ensure-presence-of-a-global-forwarder.yml file for editing. Adapt the file by setting the following variables: Change the name variable for the playbook to Playbook to ensure the presence of a global forwarder in IdM DNS . In the tasks section, change the name of the task to Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53 . In the forwarders section of the ipadnsconfig portion: Change the first ip_address value to the IPv4 address of the global forwarder: 7.7.9.9 . Change the second ip_address value to the IPv6 address of the global forwarder: 2001:db8::1:0 . Verify the port value is set to 53 . Change the state to present . This the modified Ansible playbook file for the current example: Save the file. Run the playbook: Additional resources The README-dnsconfig.md file in the /usr/share/doc/ansible-freeipa/ directory 27.3. Ensuring the absence of a DNS global forwarder in IdM using Ansible Follow this procedure to use an Ansible playbook to ensure the absence of a DNS global forwarder in IdM. In the example procedure below, the IdM administrator ensures the absence of a DNS global forwarder with an Internet Protocol (IP) v4 address of 8.8.6.6 and IP v6 address of 2001:4860:4860::8800 on port 53 . Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You know the IdM administrator password. Procedure Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory: Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the forwarders-absent.yml Ansible playbook file. For example: Open the ensure-absence-of-a-global-forwarder.yml file for editing. Adapt the file by setting the following variables: Change the name variable for the playbook to Playbook to ensure the absence of a global forwarder in IdM DNS . In the tasks section, change the name of the task to Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53 . In the forwarders section of the ipadnsconfig portion: Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6 . Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800 . Verify the port value is set to 53 . Set the action variable to member . Verify the state is set to absent . This the modified Ansible playbook file for the current example: Important If you only use the state: absent option in your playbook without also using action: member , the playbook fails. Save the file. Run the playbook: Additional resources The README-dnsconfig.md file in the /usr/share/doc/ansible-freeipa/ directory The action: member option in ipadnsconfig ansible-freeipa modules 27.4. The action: member option in ipadnsconfig ansible-freeipa modules Excluding global forwarders in Identity Management (IdM) by using the ansible-freeipa ipadnsconfig module requires using the action: member option in addition to the state: absent option. If you only use state: absent in your playbook without also using action: member , the playbook fails. Consequently, to remove all global forwarders, you must specify all of them individually in the playbook. In contrast, the state: present option does not require action: member . The following table provides configuration examples for both adding and removing DNS global forwarders that demonstrate the correct use of the action: member option. The table shows, in each line: The global forwarders configured before executing a playbook An excerpt from the playbook The global forwarders configured after executing the playbook Table 27.1. ipadnsconfig management of global forwarders Forwarders before Playbook excerpt Forwarders after 8.8.6.6 8.8.6.7 8.8.6.6 8.8.6.6, 8.8.6.7 8.8.6.6, 8.8.6.7 Trying to execute the playbook results in an error. The original configuration - 8.8.6.6, 8.8.6.7 - is left unchanged. 8.8.6.6, 8.8.6.7 8.8.6.6 27.5. DNS forward policies in IdM IdM supports the first and only standard BIND forward policies, as well as the none IdM-specific forward policy. Forward first (default) The IdM BIND service forwards DNS queries to the configured forwarder. If a query fails because of a server error or timeout, BIND falls back to the recursive resolution using servers on the Internet. The forward first policy is the default policy, and it is suitable for optimizing DNS traffic. Forward only The IdM BIND service forwards DNS queries to the configured forwarder. If a query fails because of a server error or timeout, BIND returns an error to the client. The forward only policy is recommended for environments with split DNS configuration. None (forwarding disabled) DNS queries are not forwarded with the none forwarding policy. Disabling forwarding is only useful as a zone-specific override for global forwarding configuration. This option is the IdM equivalent of specifying an empty list of forwarders in BIND configuration. Note You cannot use forwarding to combine data in IdM with data from other DNS servers. You can only forward queries for specific subzones of the primary zone in IdM DNS. By default, the BIND service does not forward queries to another server if the queried DNS name belongs to a zone for which the IdM server is authoritative. In such a situation, if the queried DNS name cannot be found in the IdM database, the NXDOMAIN answer is returned. Forwarding is not used. Example 27.1. Example Scenario The IdM server is authoritative for the test.example. DNS zone. BIND is configured to forward queries to the DNS server with the 192.0.2.254 IP address. When a client sends a query for the nonexistent.test.example. DNS name, BIND detects that the IdM server is authoritative for the test.example. zone and does not forward the query to the 192.0.2.254. server. As a result, the DNS client receives the NXDomain error message, informing the user that the queried domain does not exist. 27.6. Using an Ansible playbook to ensure that the forward first policy is set in IdM DNS global configuration Follow this procedure to use an Ansible playbook to ensure that global forwarding policy in IdM DNS is set to forward first . If you use the forward first DNS forwarding policy, DNS queries are forwarded to the configured forwarder. If a query fails because of a server error or timeout, BIND falls back to the recursive resolution using servers on the Internet. The forward first policy is the default policy. It is suitable for traffic optimization. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You know the IdM administrator password. Your IdM environment contains an integrated DNS server. Procedure Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory: Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the set-configuration.yml Ansible playbook file. For example: Open the set-forward-policy-to-first.yml file for editing. Adapt the file by setting the following variables in the ipadnsconfig task section: Set the ipaadmin_password variable to your IdM administrator password. Set the forward_policy variable to first . Delete all the other lines of the original playbook that are irrelevant. This is the modified Ansible playbook file for the current example: Save the file. Run the playbook: Additional resources DNS forward policies in IdM The README-dnsconfig.md file in the /usr/share/doc/ansible-freeipa/ directory For more sample playbooks, see the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory. 27.7. Using an Ansible playbook to ensure that global forwarders are disabled in IdM DNS Follow this procedure to use an Ansible playbook to ensure that global forwarders are disabled in IdM DNS. The disabling is done by setting the forward_policy variable to none . Disabling global forwarders causes DNS queries not to be forwarded. Disabling forwarding is only useful as a zone-specific override for global forwarding configuration. This option is the IdM equivalent of specifying an empty list of forwarders in BIND configuration. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You know the IdM administrator password. Your IdM environment contains an integrated DNS server. Procedure Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory: Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the disable-global-forwarders.yml Ansible playbook file. For example: Open the disable-global-forwarders-copy.yml file for editing. Adapt the file by setting the following variables in the ipadnsconfig task section: Set the ipaadmin_password variable to your IdM administrator password. Set the forward_policy variable to none . This is the modified Ansible playbook file for the current example: Save the file. Run the playbook: Additional resources DNS forward policies in IdM The README-dnsconfig.md file in the /usr/share/doc/ansible-freeipa/ directory Sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory 27.8. Using an Ansible playbook to ensure that synchronization of forward and reverse lookup zones is disabled in IdM DNS Follow this procedure to use an Ansible playbook to ensure that forward and reverse lookup zones are not synchronized in IdM DNS. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You know the IdM administrator password. Your IdM environment contains an integrated DNS server. Procedure Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory: Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the disallow-reverse-sync.yml Ansible playbook file. For example: Open the disallow-reverse-sync-copy.yml file for editing. Adapt the file by setting the following variables in the ipadnsconfig task section: Set the ipaadmin_password variable to your IdM administrator password. Set the allow_sync_ptr variable to no . This is the modified Ansible playbook file for the current example: Save the file. Run the playbook: Additional resources The README-dnsconfig.md file in the /usr/share/doc/ansible-freeipa/ directory For more sample playbooks, see the /usr/share/doc/ansible-freeipa/playbooks/dnsconfig directory.

Commands:
Generated by NetworkManager search idm.example.com nameserver 127.0.0.1
auto-generated by IPA installer [main] dns=default [global-dns] searches=USDDOMAIN [global-dns-domain-*] servers=127.0.0.1
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml
--- - name: Playbook to ensure the presence of a global forwarder in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53 ipadnsconfig: forwarders: - ip_address: 7.7.9.9 - ip_address: 2001:db8::1:0 port: 53 state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml
--- - name: Playbook to ensure the absence of a global forwarder in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53 ipadnsconfig: forwarders: - ip_address: 8.8.6.6 - ip_address: 2001:4860:4860::8800 port: 53 action: member state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml
[...] tasks: - name: Ensure the presence of DNS global forwarder 8.8.6.7 ipadnsconfig: forwarders: - ip_address: 8.8.6.7 state: present
[...] tasks: - name: Ensure the presence of DNS global forwarder 8.8.6.7 ipadnsconfig: forwarders: - ip_address: 8.8.6.7 action: member state: present
[...] tasks: - name: Ensure the absence of DNS global forwarder 8.8.6.7 ipadnsconfig: forwarders: - ip_address: 8.8.6.7 state: absent
[...] tasks: - name: Ensure the absence of DNS global forwarder 8.8.6.7 ipadnsconfig: forwarders: - ip_address: 8.8.6.7 action: member state: absent
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp set-configuration.yml set-forward-policy-to-first.yml
--- - name: Playbook to set global forwarding policy to first hosts: ipaserver become: true tasks: - name: Set global forwarding policy to first. ipadnsconfig: ipaadmin_password: "{{ ipaadmin_password }}" forward_policy: first
ansible-playbook --vault-password-file=password_file -v -i inventory.file set-forward-policy-to-first.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp disable-global-forwarders.yml disable-global-forwarders-copy.yml
--- - name: Playbook to disable global DNS forwarders hosts: ipaserver become: true tasks: - name: Disable global forwarders. ipadnsconfig: ipaadmin_password: "{{ ipaadmin_password }}" forward_policy: none
ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders-copy.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp disallow-reverse-sync.yml disallow-reverse-sync-copy.yml
--- - name: Playbook to disallow reverse record synchronization hosts: ipaserver become: true tasks: - name: Disallow reverse record synchronization. ipadnsconfig: ipaadmin_password: "{{ ipaadmin_password }}" allow_sync_ptr: no
ansible-playbook --vault-password-file=password_file -v -i inventory.file disallow-reverse-sync-copy.yml