Working with DNS in Identity Management Red Hat Enterprise Linux 8 Managing the IdM-integrated DNS service Red Hat Customer Content Services

Commands:
Generated by NetworkManager search idm.example.com nameserver 127.0.0.1
auto-generated by IPA installer [main] dns=default [global-dns] searches=USDDOMAIN [global-dns-domain-*] servers=127.0.0.1
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml
--- - name: Playbook to ensure the presence of a global forwarder in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53 ipadnsconfig: forwarders: - ip_address: 7.7.9.9 - ip_address: 2001:db8::1:0 port: 53 state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml
--- - name: Playbook to ensure the absence of a global forwarder in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53 ipadnsconfig: forwarders: - ip_address: 8.8.6.6 - ip_address: 2001:4860:4860::8800 port: 53 action: member state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml
[...] tasks: - name: Ensure the presence of DNS global forwarder 8.8.6.7 ipadnsconfig: forwarders: - ip_address: 8.8.6.7 state: present
[...] tasks: - name: Ensure the presence of DNS global forwarder 8.8.6.7 ipadnsconfig: forwarders: - ip_address: 8.8.6.7 action: member state: present
[...] tasks: - name: Ensure the absence of DNS global forwarder 8.8.6.7 ipadnsconfig: forwarders: - ip_address: 8.8.6.7 state: absent
[...] tasks: - name: Ensure the absence of DNS global forwarder 8.8.6.7 ipadnsconfig: forwarders: - ip_address: 8.8.6.7 action: member state: absent
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp set-configuration.yml set-forward-policy-to-first.yml
--- - name: Playbook to set global forwarding policy to first hosts: ipaserver become: true tasks: - name: Set global forwarding policy to first. ipadnsconfig: ipaadmin_password: "{{ ipaadmin_password }}" forward_policy: first
ansible-playbook --vault-password-file=password_file -v -i inventory.file set-forward-policy-to-first.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp disable-global-forwarders.yml disable-global-forwarders-copy.yml
--- - name: Playbook to disable global DNS forwarders hosts: ipaserver become: true tasks: - name: Disable global forwarders. ipadnsconfig: ipaadmin_password: "{{ ipaadmin_password }}" forward_policy: none
ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders-copy.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp disallow-reverse-sync.yml disallow-reverse-sync-copy.yml
--- - name: Playbook to disallow reverse record synchronization hosts: ipaserver become: true tasks: - name: Disallow reverse record synchronization. ipadnsconfig: ipaadmin_password: "{{ ipaadmin_password }}" allow_sync_ptr: no
ansible-playbook --vault-password-file=password_file -v -i inventory.file disallow-reverse-sync-copy.yml
ipa dnszone-add newzone.idm.example.com
ipa dnszone-del idm.example.com
ipa dnszone-mod --retry 1800
ipa dnszone-mod --allow-transfer=192.0.2.1;198.51.100.1;203.0.113.1 idm.example.com
ssh 192.0.2.1
dig @ipa-server zone_name AXFR
cd /usr/share/doc/ansible-freeipa/playbooks/dnszone
[ipaserver] server.idm.example.com
cp dnszone-present.yml dnszone-present-copy.yml
--- - name: Ensure dnszone present hosts: ipaserver become: true tasks: - name: Ensure zone is present. ipadnszone: ipaadmin_password: "{{ ipaadmin_password }}" zone_name: zone.idm.example.com state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-present-copy.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnszone
[ipaserver] server.idm.example.com
cp dnszone-all-params.yml dnszone-all-params-copy.yml
--- - name: Ensure dnszone present hosts: ipaserver become: true tasks: - name: Ensure zone is present. ipadnszone: ipaadmin_password: "{{ ipaadmin_password }}" zone_name: zone.idm.example.com allow_sync_ptr: true dynamic_update: true dnssec: true allow_transfer: - 1.1.1.1 - 2.2.2.2 allow_query: - 1.1.1.1 - 2.2.2.2 forwarders: - ip_address: 8.8.8.8 - ip_address: 8.8.4.4 port: 52 serial: 1234 refresh: 3600 retry: 900 expire: 1209600 minimum: 3600 ttl: 60 default_ttl: 90 name_server: server.idm.example.com. admin_email: admin.admin@idm.example.com nsec3param_rec: "1 7 100 0123456789abcdef" skip_overlap_check: true skip_nameserver_check: true state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-all-params-copy.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnszone
[ipaserver] server.idm.example.com
cp dnszone-reverse-from-ip.yml dnszone-reverse-from-ip-copy.yml
--- - name: Ensure dnszone present hosts: ipaserver become: true tasks: - name: Ensure zone for reverse DNS lookup is present. ipadnszone: ipaadmin_password: "{{ ipaadmin_password }}" name_from_ip: 192.168.1.2/24 state: present register: result - name: Display inferred zone name. debug: msg: "Zone name: {{ result.dnszone.name }}"
ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-reverse-from-ip-copy.yml
dig -t SRV +short _kerberos._tcp.idm.example.com 0 100 88 idmserver-01.idm.example.com. 0 100 88 idmserver-02.idm.example.com.
dig -t SRV +short _kerberos._tcp.idm.example.com _kerberos._tcp.germany._locations.idm.example.com. 0 100 88 idmserver-01.idm.example.com. 50 100 88 idmserver-02.idm.example.com.
ipa location-add germany ---------------------------- Added IPA location "germany" ---------------------------- Location name: germany
systemctl restart named-pkcs11
ipa location-find ----------------------- 2 IPA locations matched ----------------------- Location name: australia Location name: germany ----------------------------- Number of entries returned: 2 -----------------------------
ipa server-mod idmserver-01.idm.example.com --location=germany ipa: WARNING: Service named-pkcs11.service requires restart on IPA server idmserver-01.idm.example.com to apply configuration changes. -------------------------------------------------- Modified IPA server "idmserver-01.idm.example.com" -------------------------------------------------- Servername: idmserver-01.idm.example.com Min domain level: 0 Max domain level: 1 Location: germany Enabled server roles: DNS server, NTP server
systemctl restart named-pkcs11
nameserver 10.10.0.1 nameserver 10.10.0.2
nameserver 10.50.0.1 nameserver 10.50.0.3
nameserver 10.30.0.1
nameserver 10.30.0.1
dig -t SRV +short _kerberos._tcp.idm.example.com 0 100 88 idmserver-01.idm.example.com. 0 100 88 idmserver-02.idm.example.com.
dig -t SRV +short _kerberos._tcp.idm.example.com _kerberos._tcp.germany._locations.idm.example.com. 0 100 88 idmserver-01.idm.example.com. 50 100 88 idmserver-02.idm.example.com.
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/location/location-present.yml location-present-copy.yml
--- - name: location present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that the "germany" location is present ipalocation: ipaadmin_password: "{{ ipaadmin_password }}" name: germany
ansible-playbook --vault-password-file=password_file -v -i inventory location-present-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/location/location-absent.yml location-absent-copy.yml
--- - name: location absent example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that the "germany" location is absent ipalocation: ipaadmin_password: "{{ ipaadmin_password }}" name: germany state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory location-absent-copy.yml
[user@server ~]USD ipa dnsconfig-mod --forwarder= 10.10.0.1 Server will check DNS forwarder(s). This may take some time, please wait Global forwarders: 10.10.0.1 IPA DNS servers: server.example.com
[user@server ~]USD ipa dnsconfig-show Global forwarders: 10.10.0.1 IPA DNS servers: server.example.com
[user@server ~]USD ipa dnsforwardzone-add forward.example.com. --forwarder= 10.10.0.14 --forwarder= 10.10.1.15 --forward-policy=first Zone name: forward.example.com. Zone forwarders: 10.10.0.14, 10.10.1.15 Forward policy: first
[user@server ~]USD ipa dnsforwardzone-show forward.example.com. Zone name: forward.example.com. Zone forwarders: 10.10.0.14, 10.10.1.15 Forward policy: first
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp set-configuration.yml establish-global-forwarder.yml
--- - name: Playbook to establish a global forwarder in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 ipadnsconfig: forwarders: - ip_address: 8.8.6.6 - ip_address: 2001:4860:4860::8800 port: 53 forward_policy: first allow_sync_ptr: true
ansible-playbook --vault-password-file=password_file -v -i inventory.file establish-global-forwarder.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml
--- - name: Playbook to ensure the presence of a global forwarder in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53 ipadnsconfig: forwarders: - ip_address: 7.7.9.9 - ip_address: 2001:db8::1:0 port: 53 state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml
--- - name: Playbook to ensure the absence of a global forwarder in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53 ipadnsconfig: forwarders: - ip_address: 8.8.6.6 - ip_address: 2001:4860:4860::8800 port: 53 action: member state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cat disable-global-forwarders.yml --- - name: Playbook to disable global DNS forwarders hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Disable global forwarders. ipadnsconfig: forward_policy: none
ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-presence-forwardzone.yml
- 8.8.8.8
--- - name: Playbook to ensure the presence of a dnsforwardzone in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the presence of a dnsforwardzone for example.com to 8.8.8.8 ipadnsforwardzone: ipaadmin_password: "{{ ipaadmin_password }}" name: example.com forwarders: - 8.8.8.8 forwardpolicy: first skip_overlap_check: true state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-forwardzone.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-presence-multiple-forwarders.yml
- 8.8.8.8 - 4.4.4.4
--- - name: name: Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com ipadnsforwardzone: ipaadmin_password: "{{ ipaadmin_password }}" name: example.com forwarders: - 8.8.8.8 - 4.4.4.4 state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-forwarders.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-disabled-forwardzone.yml
--- - name: Playbook to ensure a dnsforwardzone is disabled in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure a dnsforwardzone for example.com is disabled ipadnsforwardzone: ipaadmin_password: "{{ ipaadmin_password }}" name: example.com state: disabled
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-disabled-forwardzone.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsconfig
[ipaserver] server.idm.example.com
cp forwarders-absent.yml ensure-absence-forwardzone.yml
--- - name: Playbook to ensure the absence of a dnsforwardzone in IdM DNS hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the absence of a dnsforwardzone for example.com ipadnsforwardzone: ipaadmin_password: "{{ ipaadmin_password }}" name: example.com state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-forwardzone.yml
ipa dnsrecord-add zone_name record_name -- record_type_option=data
ipa dnsrecord-add idm.example.com host1 --a-rec=192.168.122.123
ipa dnsrecord-del example.com www --a-rec 192.0.2.1
cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
[ipaserver] server.idm.example.com
cp ensure-A-and-AAAA-records-are-present.yml ensure-A-and-AAAA-records-are-present-copy.yml
--- - name: Ensure A and AAAA records are present hosts: ipaserver become: true gather_facts: false tasks: # Ensure A and AAAA records are present - name: Ensure that 'host1' has A and AAAA records. ipadnsrecord: ipaadmin_password: "{{ ipaadmin_password }}" zone_name: idm.example.com records: - name: host1 a_ip_address: 192.168.122.123 - name: host1 aaaa_ip_address: ::1
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-A-and-AAAA-records-are-present-copy.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
[ipaserver] server.idm.example.com
cp ensure-dnsrecord-with-reverse-is-present.yml ensure-dnsrecord-with-reverse-is-present-copy.yml
--- - name: Ensure DNS Record is present. hosts: ipaserver become: true gather_facts: false tasks: # Ensure that dns record is present - ipadnsrecord: ipaadmin_password: "{{ ipaadmin_password }}" name: host1 zone_name: idm.example.com ip_address: 192.168.122.45 create_reverse: true state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-dnsrecord-with-reverse-is-present-copy.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
[ipaserver] server.idm.example.com
cp ensure-presence-multiple-records.yml ensure-presence-multiple-records-copy.yml
--- - name: Test multiple DNS Records are present. hosts: ipaserver become: true gather_facts: false tasks: # Ensure that multiple dns records are present - ipadnsrecord: ipaadmin_password: "{{ ipaadmin_password }}" records: - name: host1 zone_name: idm.example.com a_rec: 192.168.122.112 a_rec: 192.168.122.122 - name: host1 zone_name: idm.example.com aaaa_rec: ::1
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-records-copy.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
[ipaserver] server.idm.example.com
cp ensure-CNAME-record-is-present.yml ensure-CNAME-record-is-present-copy.yml
--- - name: Ensure that 'www.idm.example.com' and 'ftp.idm.example.com' CNAME records point to 'host03.idm.example.com'. hosts: ipaserver become: true gather_facts: false tasks: - ipadnsrecord: ipaadmin_password: "{{ ipaadmin_password }}" zone_name: idm.example.com records: - name: www cname_hostname: host03 - name: ftp cname_hostname: host03
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-CNAME-record-is-present.yml
cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
[ipaserver] server.idm.example.com
cp ensure-SRV-record-is-present.yml ensure-SRV-record-is-present-copy.yml
--- - name: Test multiple DNS Records are present. hosts: ipaserver become: true gather_facts: false tasks: # Ensure a SRV record is present - ipadnsrecord: ipaadmin_password: "{{ ipaadmin_password }}" name: _kerberos._udp.idm.example.com srv_rec: '10 50 88 idm.example.com' zone_name: idm.example.com state: present
ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-SRV-record-is-present.yml
kinit admin
ipa host-add-principal demo.example.com --principal= demo
[libdefaults] dns_canonicalize_hostname = true