From a19cb9b5477901efc08c00c122f08e3d5ed126ff Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Tue, 21 Oct 2014 14:25:50 +0200
Subject: [PATCH] Disable DNSSEC support
---
install/share/bind.named.conf.template | 2 +-
install/tools/ipa-dns-install | 52 ++++------------------------------
install/tools/ipa-replica-install | 16 ++++-------
install/tools/ipa-replica-manage | 12 --------
install/tools/ipa-server-install | 40 +++-----------------------
install/tools/ipa-upgradeconfig | 10 -------
ipalib/plugins/dns.py | 4 ++-
ipaplatform/redhat/services.py | 6 ++--
ipapython/Makefile | 2 +-
ipapython/setup.py.in | 2 +-
ipaserver/install/bindinstance.py | 25 ----------------
11 files changed, 24 insertions(+), 147 deletions(-)
diff --git a/install/share/bind.named.conf.template b/install/share/bind.named.conf.template
index 3c19383c0dde4353b30b16240ec2b81d7ea65776..b3b06211b15cc1736453b203b52bacfba8036618 100644
--- a/install/share/bind.named.conf.template
+++ b/install/share/bind.named.conf.template
@@ -18,7 +18,7 @@ options {
pid-file "$NAMED_PID";
dnssec-enable yes;
- dnssec-validation yes;
+ dnssec-validation no;
/* Path to ISC DLV key */
bindkeys-file "$BINDKEYS_FILE";
diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install
index cbf3faeef3644870b6978e02c95f67354cc7e61b..114351c9f7a5a779e4c8516c1411139c38d7138b 100755
--- a/install/tools/ipa-dns-install
+++ b/install/tools/ipa-dns-install
@@ -23,8 +23,7 @@ from optparse import OptionGroup, SUPPRESS_HELP
import krbV
-from ipaserver.install import (service, bindinstance, ntpinstance,
- httpinstance, dnskeysyncinstance, opendnssecinstance, odsexporterinstance)
+from ipaserver.install import service, bindinstance, ntpinstance, httpinstance
from ipaserver.install.installutils import *
from ipaserver.install import installutils
from ipapython import version
@@ -54,10 +53,6 @@ def parse_options():
help="The reverse DNS zone to use")
parser.add_option("--no-reverse", dest="no_reverse", action="store_true",
default=False, help="Do not create new reverse DNS zone")
- parser.add_option("--no-dnssec-validation", dest="no_dnssec_validation", action="store_true",
- default=False, help="Disable DNSSEC validation")
- parser.add_option("--dnssec-master", dest="dnssec_master", action="store_true",
- default=False, help="Setup server to be DNSSEC key master")
parser.add_option("--zonemgr", action="callback", callback=bindinstance.zonemgr_callback,
type="string",
help="DNS zone manager e-mail address. Defaults to hostmaster@DOMAIN")
@@ -67,6 +62,10 @@ def parse_options():
options, args = parser.parse_args()
safe_options = parser.get_safe_opts(options)
+ # Disable DNSSEC support
+ options.no_dnssec_validation = False
+ options.dnssec_master = False
+
if options.forwarders and options.no_forwarders:
parser.error("You cannot specify a --forwarder option together with --no-forwarders")
elif options.reverse_zones and options.no_reverse:
@@ -101,21 +100,6 @@ def main():
print ""
print "This includes:"
print " * Configure DNS (bind)"
- print " * Configure SoftHSM (required by DNSSEC)"
- print " * Configure ipa-dnskeysyncd (required by DNSSEC)"
- if options.dnssec_master:
- print " * Configure ipa-ods-exporter (required by DNSSEC key master)"
- print " * Configure OpenDNSSEC (required by DNSSEC key master)"
- print " * Generate DNSSEC master key (required by DNSSEC key master)"
- print ""
- print "NOTE: DNSSEC zone signing is not enabled by default"
- print ""
- if options.dnssec_master:
- print "DNSSEC support is experimental!"
- print ""
- print "Plan carefully, current version doesn't allow you to move DNSSEC"
- print "key master to different server and master cannot be uninstalled"
- print ""
print ""
print "To accept the default shown in brackets, press the Enter key."
print ""
@@ -126,15 +110,9 @@ def main():
sys.exit("Aborted")
# Check bind packages are installed
- if not (bindinstance.check_inst(options.unattended) and
- dnskeysyncinstance.check_inst()):
+ if not bindinstance.check_inst(options.unattended):
sys.exit("Aborting installation.")
- if options.dnssec_master:
- # check opendnssec packages are installed
- if not opendnssecinstance.check_inst():
- sys.exit("Aborting installation")
-
# Initialize the ipalib api
cfg = dict(
in_server=True,
@@ -160,14 +138,6 @@ def main():
except errors.ACIError:
sys.exit("Password is not valid!")
- ods = opendnssecinstance.OpenDNSSECInstance(fstore, dm_password)
- if options.dnssec_master:
- dnssec_masters = ods.get_masters()
- # we can reinstall current server if it is dnssec master
- if not api.env.host in dnssec_masters and dnssec_masters:
- print "DNSSEC key master(s):", u','.join(dnssec_masters)
- sys.exit("Only one DNSSEC key master is supported in current version.")
-
ip_addresses = get_server_ip_address(api.env.host, fstore,
options.unattended, True, options.ip_addresses)
@@ -213,16 +183,6 @@ def main():
no_dnssec_validation=options.no_dnssec_validation)
bind.create_instance()
- # on dnssec master this must be installed last
- dnskeysyncd = dnskeysyncinstance.DNSKeySyncInstance(fstore, dm_password)
- dnskeysyncd.create_instance(api.env.host, api.env.realm)
- if options.dnssec_master:
- ods_exporter = odsexporterinstance.ODSExporterInstance(fstore, dm_password)
-
- ods_exporter.create_instance(api.env.host, api.env.realm)
- ods.create_instance(api.env.host, api.env.realm)
-
- dnskeysyncd.start_dnskeysyncd()
bind.start_named()
# Restart http instance to make sure that python-dns has the right resolver
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 70190b718965518803b9767325d58f9526c32f7c..b8813aaa5d54d40756e9d9b8f0ee3e2dd7e8b253 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -33,7 +33,7 @@ from ipapython import ipautil
from ipaserver.install import dsinstance, installutils, krbinstance, service
from ipaserver.install import bindinstance, httpinstance, ntpinstance
-from ipaserver.install import memcacheinstance, dnskeysyncinstance
+from ipaserver.install import memcacheinstance
from ipaserver.install import otpdinstance
from ipaserver.install.replication import replica_conn_check, ReplicationManager
from ipaserver.install.installutils import (ReplicaConfig, expand_replica_info,
@@ -112,8 +112,6 @@ def parse_options():
action="append", help="The reverse DNS zone to use")
dns_group.add_option("--no-reverse", dest="no_reverse", action="store_true",
default=False, help="Do not create new reverse DNS zone")
- dns_group.add_option("--no-dnssec-validation", dest="no_dnssec_validation", action="store_true",
- default=False, help="Disable DNSSEC validation")
dns_group.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
default=False,
help="Do not use DNS for hostname lookup during installation")
@@ -127,6 +125,9 @@ def parse_options():
# pkinit is disabled in production version
options.setup_pkinit = False
+ # Disable DNSSEC support
+ options.no_dnssec_validation = False
+
if len(args) != 1:
parser.error("you must provide a file generated by ipa-replica-prepare")
@@ -139,8 +140,6 @@ def parse_options():
parser.error("You cannot specify a --reverse-zone option without the --setup-dns option")
if options.no_reverse:
parser.error("You cannot specify a --no-reverse option without the --setup-dns option")
- if options.no_dnssec_validation:
- parser.error("You cannot specify a --no-dnssec-validation option without the --setup-dns option")
elif options.forwarders and options.no_forwarders:
parser.error("You cannot specify a --forwarder option together with --no-forwarders")
elif not options.forwarders and not options.no_forwarders:
@@ -274,10 +273,6 @@ def install_bind(config, options):
no_dnssec_validation=options.no_dnssec_validation)
bind.create_instance()
print ""
- dnskeysyncd = dnskeysyncinstance.DNSKeySyncInstance(
- dm_password=config.dirman_password)
- dnskeysyncd.create_instance(api.env.host, api.env.realm)
- dnskeysyncd.start_dnskeysyncd()
bind.start_named()
print ""
bind.check_global_configuration()
@@ -354,8 +349,7 @@ def check_dirsrv():
sys.exit(1)
def check_bind():
- if not (bindinstance.check_inst(unattended=True) and
- dnskeysyncinstance.check_inst()):
+ if not bindinstance.check_inst(unattended=True):
print "Aborting installation"
sys.exit(1)
diff --git a/install/tools/ipa-replica-manage b/install/tools/ipa-replica-manage
index 4f92c0c927b3267eeb466a06d3283823c05437b0..86d77844489abe4d7151a29a4e81320e01d5c412 100755
--- a/install/tools/ipa-replica-manage
+++ b/install/tools/ipa-replica-manage
@@ -29,7 +29,6 @@ import socket
from ipapython import ipautil
from ipaserver.install import replication, dsinstance, installutils
from ipaserver.install import bindinstance, cainstance, certs
-from ipaserver.install import opendnssecinstance, dnskeysyncinstance
from ipaserver.plugins import ldap2
from ipapython import version, ipaldap
from ipalib import api, errors, util
@@ -695,14 +694,6 @@ def del_master(realm, hostname, options):
if not options.force and not ipautil.user_input("Continue to delete?", False):
sys.exit("Deletion aborted")
- # test if replica is not DNSSEC master
- # allow to delete it if is last DNS server
- if 'DNS' in this_services and other_dns and not options.force:
- dnssec_masters = opendnssecinstance.get_dnssec_key_masters(delrepl.conn)
- if hostname in dnssec_masters:
- print "Replica is active DNSSEC key master. Uninstall could break your DNS system."
- sys.exit("Deletion aborted")
-
# Pick CA renewal master
ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
if ca.is_renewal_master(hostname):
@@ -757,9 +748,6 @@ def del_master(realm, hostname, options):
bind.remove_master_dns_records(hostname, realm, realm.lower())
bind.remove_ipa_ca_dns_records(hostname, realm.lower())
bind.remove_server_ns_records(hostname)
-
- keysyncd = dnskeysyncinstance.DNSKeySyncInstance()
- keysyncd.remove_replica_public_keys(hostname)
except Exception, e:
print "Failed to cleanup %s DNS entries: %s" % (hostname, e)
print "You may need to manually remove them from the tree"
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 3b748aaab37fa8806ebc7a4983ed97cc8243a9c4..6bcb0a16dbdfc0258ab40c70ea94740dfb537d8a 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -49,9 +49,6 @@ except ImportError:
from ipaserver.install import dsinstance
from ipaserver.install import krbinstance
from ipaserver.install import bindinstance
-from ipaserver.install import dnskeysyncinstance
-from ipaserver.install import opendnssecinstance
-from ipaserver.install import odsexporterinstance
from ipaserver.install import httpinstance
from ipaserver.install import ntpinstance
from ipaserver.install import certs
@@ -272,8 +269,6 @@ def parse_options():
action="append", default=[])
dns_group.add_option("--no-reverse", dest="no_reverse", action="store_true",
default=False, help="Do not create reverse DNS zone")
- dns_group.add_option("--no-dnssec-validation", dest="no_dnssec_validation", action="store_true",
- default=False, help="Disable DNSSEC validation")
dns_group.add_option("--zonemgr", action="callback", callback=bindinstance.zonemgr_callback,
type="string",
help="DNS zone manager e-mail address. Defaults to hostmaster@DOMAIN")
@@ -297,6 +292,9 @@ def parse_options():
options.pkinit_pin = False
options.pkinit_cert_files = False
+ # Disable DNSSEC support
+ options.no_dnssec_validation = False
+
if options.dm_password is not None:
try:
validate_dm_password(options.dm_password)
@@ -323,8 +321,6 @@ def parse_options():
parser.error("You cannot specify a --reverse-zone option without the --setup-dns option")
if options.no_reverse:
parser.error("You cannot specify a --no-reverse option without the --setup-dns option")
- if options.no_dnssec_validation:
- parser.error("You cannot specify a --no-dnssec-validation option without the --setup-dns option")
elif options.forwarders and options.no_forwarders:
parser.error("You cannot specify a --forwarder option together with --no-forwarders")
elif options.reverse_zones and options.no_reverse:
@@ -564,17 +560,7 @@ def uninstall():
api.env.realm, certs.NSS_DIR, dogtag_constants=dogtag_constants)
if ca_instance.is_configured():
ca_instance.uninstall()
-
- ods = opendnssecinstance.OpenDNSSECInstance(fstore)
- if ods.is_configured():
- ods.uninstall()
-
- ods_exporter = odsexporterinstance.ODSExporterInstance(fstore)
- if ods_exporter.is_configured():
- ods_exporter.uninstall()
-
bindinstance.BindInstance(fstore).uninstall()
- dnskeysyncinstance.DNSKeySyncInstance(fstore).uninstall()
httpinstance.HTTPInstance(fstore).uninstall()
krbinstance.KrbInstance(fstore).uninstall()
dsinstance.DsInstance(fstore=fstore).uninstall()
@@ -737,20 +723,6 @@ def main():
"agreements.\n\n")
print textwrap.fill(msg, width=80, replace_whitespace=False)
else:
-
- # test if server is DNSSEC key master
- masters = opendnssecinstance.get_dnssec_key_masters(conn)
- if api.env.host in masters:
- print "This server is active DNSSEC key master. Uninstall could break your DNS system."
- if not (options.unattended or user_input("Are you sure you "
- "want to continue "
- "with the uninstall "
- "procedure?",
- False)):
- print ""
- print "Aborting uninstall operation."
- sys.exit(1)
-
rm = replication.ReplicationManager(
realm=api.env.realm,
hostname=api.env.host,
@@ -899,8 +871,7 @@ def main():
# check bind packages are installed
if options.setup_dns:
- if not (bindinstance.check_inst(options.unattended) and
- dnskeysyncinstance.check_inst()):
+ if not bindinstance.check_inst(options.unattended):
sys.exit("Aborting installation")
# Don't require an external DNS to say who we are if we are
@@ -1289,9 +1260,6 @@ def main():
api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dm_password)
bind.create_instance()
- dnskeysyncd = dnskeysyncinstance.DNSKeySyncInstance(fstore, dm_password)
- dnskeysyncd.create_instance(api.env.host, api.env.realm)
- dnskeysyncd.start_dnskeysyncd()
bind.start_named()
print ""
bind.check_global_configuration()
diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig
index cd50edeecb055c71831fad806afde43c2779cdf8..cf85f58c26510fcd105b54126152a50474c869b5 100755
--- a/install/tools/ipa-upgradeconfig
+++ b/install/tools/ipa-upgradeconfig
@@ -53,7 +53,6 @@ from ipaserver.install import cainstance
from ipaserver.install import certs
from ipaserver.install import otpdinstance
from ipaserver.install import sysupgrade
-from ipaserver.install import dnskeysyncinstance
def parse_options():
@@ -1421,14 +1420,6 @@ def main():
except ipalib.errors.DuplicateEntry:
pass
- # install DNSKeySync service only if DNS is configured on server
- if bindinstance.named_conf_exists():
- dnskeysyncd = dnskeysyncinstance.DNSKeySyncInstance(fstore, ldapi=True)
- if not dnskeysyncd.is_configured():
- ds.start()
- dnskeysyncd.create_instance(fqdn, api.env.realm)
- dnskeysyncd.start_dnskeysyncd()
-
cleanup_kdc(fstore)
cleanup_adtrust(fstore)
setup_firefox_extension(fstore)
@@ -1447,7 +1438,6 @@ def main():
named_bindkey_file_option(),
named_managed_keys_dir_option(),
named_root_key_include(),
- mask_named_regular(),
)
if any(named_conf_changes):
diff --git a/ipalib/plugins/dns.py b/ipalib/plugins/dns.py
index ea4c212b42631e8513a13d2a7f5a859b2176376b..60129f8b873fad1d3552ca749068f36db41108e9 100644
--- a/ipalib/plugins/dns.py
+++ b/ipalib/plugins/dns.py
@@ -2389,7 +2389,9 @@ class dnszone(DNSZoneBase):
if options['idnssecinlinesigning'] is True:
messages.add_message(options['version'], result,
messages.DNSSECWarning(
- additional_info=_("Visit 'http://www.freeipa.org/page/Releases/4.1.0#DNSSEC_Support'.")
+ additional_info=_("Manual configuration needed, please "
+ "visit 'http://www.freeipa.org/page/Releases/4.0.0#"
+ "Experimental_DNSSEC_Support'")
))
else:
messages.add_message(options['version'], result,
diff --git a/ipaplatform/redhat/services.py b/ipaplatform/redhat/services.py
index 20d0adec421ecd3285464e2a51b9d5c61a0e3d92..5c9bae56552cefec1f3b8a16a52b8704171d4024 100644
--- a/ipaplatform/redhat/services.py
+++ b/ipaplatform/redhat/services.py
@@ -69,7 +69,7 @@ redhat_system_units['ipa-otpd'] = 'ipa-otpd.socket'
redhat_system_units['ipa-dnskeysyncd'] = 'ipa-dnskeysyncd.service'
redhat_system_units['named-regular'] = 'named.service'
redhat_system_units['named-pkcs11'] = 'named-pkcs11.service'
-redhat_system_units['named'] = redhat_system_units['named-pkcs11']
+redhat_system_units['named'] = redhat_system_units['named-regular']
redhat_system_units['ods-enforcerd'] = 'ods-enforcerd.service'
redhat_system_units['ods_enforcerd'] = redhat_system_units['ods-enforcerd']
redhat_system_units['ods-signerd'] = 'ods-signerd.service'
@@ -242,10 +242,10 @@ class RedHatNamedService(RedHatService):
return u'named'
def get_binary_path(self):
- return paths.NAMED_PKCS11
+ return paths.NAMED
def get_package_name(self):
- return u"bind-pkcs11"
+ return u"bind"
class RedHatODSEnforcerdService(RedHatService):
diff --git a/ipapython/Makefile b/ipapython/Makefile
index b2cf719fdd580801a147def17e5a7483665b3d79..e09956ad32cf48d1ed585a494c8083e58c48d037 100644
--- a/ipapython/Makefile
+++ b/ipapython/Makefile
@@ -3,7 +3,7 @@ PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/ipa
CONFIGDIR ?= $(DESTDIR)/etc/ipa
TESTS = $(wildcard test/*.py)
-SUBDIRS = py_default_encoding ipap11helper
+SUBDIRS = py_default_encoding
all:
@for subdir in $(SUBDIRS); do \
diff --git a/ipapython/setup.py.in b/ipapython/setup.py.in
index 6caf179051533e0db77a4091db5874bbdae426c9..a839f094ac0f9a2c303862e397bb4deb7589cc62 100644
--- a/ipapython/setup.py.in
+++ b/ipapython/setup.py.in
@@ -65,7 +65,7 @@ def setup_package():
classifiers=filter(None, CLASSIFIERS.split('\n')),
platforms = ["Linux", "Solaris", "Unix"],
package_dir = {'ipapython': ''},
- packages = [ "ipapython", "ipapython.dnssec" ],
+ packages = [ "ipapython" ],
)
finally:
del sys.path[0]
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index 547cf19ee36140b5f29fcf7d217933fa68e1952b..9085cf9b59a064d82c0df774a6fa961c9d158ccf 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -543,7 +543,6 @@ class BindInstance(service.Service):
self.sub_dict = None
self.reverse_zones = []
self.dm_password = dm_password
- self.named_regular = services.service('named-regular')
if fstore:
self.fstore = fstore
@@ -652,8 +651,6 @@ class BindInstance(service.Service):
if self.get_state("running") is None:
# first time store status
self.backup_state("running", self.is_running())
- self.backup_state("named-regular-running",
- self.named_regular.is_running())
self.restart()
except Exception as e:
root_logger.error("Named service failed to start (%s)", e)
@@ -662,8 +659,6 @@ class BindInstance(service.Service):
def __enable(self):
if self.get_state("enabled") is None:
self.backup_state("enabled", self.is_running())
- self.backup_state("named-regular-enabled",
- self.named_regular.is_running())
# We do not let the system start IPA components on its own,
# Instead we reply on the IPA init script to start only enabled
# components as found in our LDAP configuration tree
@@ -674,17 +669,6 @@ class BindInstance(service.Service):
# don't crash, just report error
root_logger.error("DNS service already exists")
- # disable named, we need to run named-pkcs11 only
- try:
- self.named_regular.stop()
- except Exception as e:
- root_logger.debug("Unable to stop named (%s)", e)
-
- try:
- self.named_regular.mask()
- except Exception as e:
- root_logger.debug("Unable to mask named (%s)", e)
-
def __setup_sub_dict(self):
if self.forwarders:
fwds = "\n"
@@ -1167,8 +1151,6 @@ class BindInstance(service.Service):
running = self.restore_state("running")
enabled = self.restore_state("enabled")
- named_regular_running = self.restore_state("named-regular-running")
- named_regular_enabled = self.restore_state("named-regular-enabled")
self.dns_backup.clear_records(api.Backend.ldap2.isconnected())
@@ -1187,10 +1169,3 @@ class BindInstance(service.Service):
if not running is None and running:
self.start()
-
- self.named_regular.unmask()
- if named_regular_enabled:
- self.named_regular.enable()
-
- if named_regular_running:
- self.named_regular.start()
--
2.1.0