diff options
| author | Martin Kosek <mkosek@redhat.com> | 2012-04-02 14:57:33 +0200 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2012-04-01 21:17:28 -0400 |
| commit | cf8f2f86ec52a1de90df6ea434463aa6417ef8ea (patch) | |
| tree | f4523ef33ed76f4daab82c678a139394a91b1f35 /install | |
| parent | 57950b959e1d981ecd5a2d3689ea99d8265789e0 (diff) | |
| download | freeipa.git-cf8f2f86ec52a1de90df6ea434463aa6417ef8ea.tar.gz freeipa.git-cf8f2f86ec52a1de90df6ea434463aa6417ef8ea.tar.xz freeipa.git-cf8f2f86ec52a1de90df6ea434463aa6417ef8ea.zip | |
Forbid public access to DNS tree
With a publicly accessible DNS tree in LDAP, anyone with an access
to the LDAP server can get all DNS data as with a zone transfer
which is already restricted with ACL. Making DNS tree not readable
to public is a common security practice and should be applied
in FreeIPA as well.
This patch adds a new deny rule to forbid access to DNS tree to
users or hosts without an appropriate permission or users which
are not members of admins group. The new permission/aci is
applied both for new installs and upgraded servers.
bind-dyndb-ldap plugin is allowed to read DNS tree without any
change because its principal is already a member of "DNS
Servers" privilege.
https://fedorahosted.org/freeipa/ticket/2569
Diffstat (limited to 'install')
| -rw-r--r-- | install/share/dns.ldif | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/install/share/dns.ldif b/install/share/dns.ldif index 3fd8cfb8..a8d27788 100644 --- a/install/share/dns.ldif +++ b/install/share/dns.ldif @@ -4,6 +4,7 @@ objectClass: idnsConfigObject objectClass: nsContainer objectClass: top cn: dns +aci: (targetattr = "*")(version 3.0; acl "No access to DNS tree without a permission"; deny (read,search,compare) (groupdn != "ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX") and (groupdn != "ldap:///cn=read dns entries,cn=permissions,cn=pbac,$SUFFIX");) dn: $SUFFIX changetype: modify @@ -56,6 +57,17 @@ description: Update DNS entries member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX +dn: cn=read dns entries,cn=permissions,cn=pbac,$SUFFIX +changetype: add +objectClass: top +objectClass: groupofnames +objectClass: ipapermission +cn: read dns entries +description: Read DNS entries +ipapermissiontype: SYSTEM +member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX +member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX + dn: cn=Write DNS Configuration,cn=permissions,cn=pbac,$SUFFIX changetype: add objectClass: groupofnames |