Bug 798355 - Fill DNS update policy by default
Fill DNS update policy by default
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa (Show other bugs)
Unspecified Unspecified
high Severity unspecified
: rc
: ---
Assigned To: Rob Crittenden
Namita Soman
Depends On:
  Show dependency treegraph
Reported: 2012-02-28 12:54 EST by Rob Crittenden
Modified: 2015-05-20 11:46 EDT (History)
4 users (show)

See Also:
Fixed In Version: ipa-3.0.0-1.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-02-21 04:10:03 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Rob Crittenden 2012-02-28 12:54:25 EST
This bug is created as a clone of upstream ticket:

For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, one need to create also an update policy:

ipa dnszone-mod example.com --dynamic-update=TRUE \
 --update-policy="grant EXAMPLE.COM krb5-self * A; grant EXAMPLE.COM krb5-self * AAAA; grant EXAMPLE.COM krb5-self * SSHFP;"

It can be difficult to create this policy for regular users, we should rather fill the policy by default and let user just switch dynamic updates to on or off:
ipa dnszone-mod example.com --dynamic-update=TRUE
ipa dnszone-mod example.com --dynamic-update=FALSE
Comment 1 Martin Kosek 2012-06-05 02:43:51 EDT
Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/c06cbb12ac2080e75578645b5e74adf7496de1fa

Forward and reverse zone has update policy is now automatically generated when the zone is being created.
Comment 9 errata-xmlrpc 2013-02-21 04:10:03 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.