Bug 1132233

Summary:	Dnssec trigger does not allow admin set searchdomains.
Product:	[Fedora] Fedora	Reporter:	William Brown <william>
Component:	dnssec-trigger	Assignee:	Pavel Šimerda (pavlix) <psimerda>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	20	CC:	psimerda, pspacek, pwouters, thozza, vonsch, william
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-01-21 16:02:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description William Brown 2014-08-21 01:03:36 UTC

Description of problem:
dnssec triggers documentation states that it does not configure searchdomains from dhcp due to the potential for abuse. This seems reasonable, and I can't criticise it.

My issue is thus two fold:
1) Admins should have a configurable setting that re-enables dhcp provided search domains, acknowledging the potential risk.
2) Search domains entered manually in NetworkManager are currently not used. These should be added by dnssec-trigger, as they again show admin intent and acknowledgement of the risks.

Comment 1 Pavel Šimerda (pavlix) 2014-09-23 08:25:27 UTC

(In reply to William Brown from comment #0)
> Description of problem:
> dnssec triggers documentation states that it does not configure
> searchdomains from dhcp due to the potential for abuse. This seems
> reasonable, and I can't criticise it.

You need to specify the exact way you are using it. The standard way in Fedora is to use dnssec-trigger with NetworkManager and then it's not true and it depends on `/etc/dnssec.conf`. The current stable f20 version should work for you.

> My issue is thus two fold:
> 1) Admins should have a configurable setting that re-enables dhcp provided
> search domains, acknowledging the potential risk.

Granted.

> 2) Search domains entered manually in NetworkManager are currently not used.

How do you enter those manually? Can you use `nmcli` to print them out? If yes, then we can fix the situation. Otherwise we have to extend NetworkManager first.

> These should be added by dnssec-trigger, as they again show admin intent and
> acknowledgement of the risks.

Definitely.

Comment 2 Tomáš Hozza 2014-09-23 08:54:18 UTC

(In reply to Pavel Šimerda (pavlix) from comment #1)
> (In reply to William Brown from comment #0)
> > Description of problem:
> > dnssec triggers documentation states that it does not configure
> > searchdomains from dhcp due to the potential for abuse. This seems
> > reasonable, and I can't criticise it.
> 
> You need to specify the exact way you are using it. The standard way in
> Fedora is to use dnssec-trigger with NetworkManager and then it's not true
> and it depends on `/etc/dnssec.conf`. The current stable f20 version should
> work for you.

I understood the issue is that the resolv.conf generated by dnssec-trigger does not contain search domains. I don't think there is anything in /etc/dnssec.conf that could help you with that. If dnssec-trigger does not allow search domains to be set (if explicitly configured by admin), then it should be extended to do so.

Comment 3 Tomáš Hozza 2014-09-23 08:58:08 UTC

Now I realized that this bug is most probably duplicate of Bug #1130502

Comment 4 William Brown 2014-09-26 05:57:58 UTC

> > 2) Search domains entered manually in NetworkManager are currently not used.
> 
> How do you enter those manually? Can you use `nmcli` to print them out? If
> yes, then we can fix the situation. Otherwise we have to extend
> NetworkManager first.
> 

nmcli connection edit enp0s25
nmcli> print all
ipv4.dns-search:                        services.example.com


> I understood the issue is that the resolv.conf generated by dnssec-trigger
> does not contain search domains. I don't think there is anything in
> /etc/dnssec.conf that could help you with that. If dnssec-trigger does not
> allow search domains to be set (if explicitly configured by admin), then it
> should be extended to do so.

Well, that resolv.conf is immutable anyway, so that doesn't help.

I was thinking more the insertion of these searchdomains into unbound via some means. 

If that's not possible, then yes, resolv.conf it will have to be.

Comment 5 Pavel Šimerda (pavlix) 2015-01-21 16:02:09 UTC

Please update the other bug to include information from this one. I'll try to do it if noone else comes first.

*** This bug has been marked as a duplicate of bug 1130502 ***