summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/bindinstance.py
diff options
context:
space:
mode:
authorMartin Kosek <mkosek@redhat.com>2012-06-04 17:53:34 +0200
committerMartin Kosek <mkosek@redhat.com>2012-06-05 08:41:46 +0200
commitc06cbb12ac2080e75578645b5e74adf7496de1fa (patch)
tree021a48a1886b192f444e0384ad0aee432f17b2b7 /ipaserver/install/bindinstance.py
parent7d9abecbb6b2779e074616ca5563714d165bb49b (diff)
downloadfreeipa-c06cbb12ac2080e75578645b5e74adf7496de1fa.tar.gz
freeipa-c06cbb12ac2080e75578645b5e74adf7496de1fa.tar.xz
freeipa-c06cbb12ac2080e75578645b5e74adf7496de1fa.zip
Fill new DNS zone update policy by default
For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just switch the policy on or off. https://fedorahosted.org/freeipa/ticket/2441
Diffstat (limited to 'ipaserver/install/bindinstance.py')
-rw-r--r--ipaserver/install/bindinstance.py7
1 files changed, 4 insertions, 3 deletions
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index caac8b4f2..24415556c 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -32,7 +32,8 @@ from ipapython import sysrestore
from ipapython import ipautil
from ipalib.constants import DNS_ZONE_REFRESH
from ipalib.parameters import IA5Str
-from ipalib.util import validate_zonemgr, normalize_zonemgr, gen_dns_update_policy
+from ipalib.util import (validate_zonemgr, normalize_zonemgr,
+ get_dns_forward_zone_update_policy, get_dns_reverse_zone_update_policy)
from ipapython.ipa_log_manager import *
import ipalib
@@ -185,7 +186,7 @@ def read_reverse_zone(default, ip_address):
def add_zone(name, zonemgr=None, dns_backup=None, ns_hostname=None, ns_ip_address=None,
update_policy=None):
if update_policy is None:
- update_policy = gen_dns_update_policy(api.env.realm)
+ update_policy = get_dns_forward_zone_update_policy(api.env.realm)
if zonemgr is None:
zonemgr = 'hostmaster.%s' % name
@@ -229,7 +230,7 @@ def add_reverse_zone(zone, ns_hostname=None, ns_ip_address=None,
ns_replicas=[], update_policy=None, dns_backup=None):
zone = normalize_zone(zone)
if update_policy is None:
- update_policy = "grant %s krb5-subdomain %s PTR;" % (api.env.realm, zone)
+ update_policy = get_dns_reverse_zone_update_policy(api.env.realm, zone)
if ns_hostname is None:
# automatically retrieve list of DNS masters