diff options
| author | Martin Kosek <mkosek@redhat.com> | 2012-04-02 14:57:33 +0200 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2012-04-01 21:17:04 -0400 |
| commit | df13cdcb974e9f8b161be35fcef9651c2ffe0b5e (patch) | |
| tree | 6c3e7ee8be605e4c37998ecdedca40f7da184c5e /ipalib/plugins/migration.py | |
| parent | 874a298b073997ec6b1e5a119210c7f0975aed18 (diff) | |
| download | freeipa.git-df13cdcb974e9f8b161be35fcef9651c2ffe0b5e.tar.gz freeipa.git-df13cdcb974e9f8b161be35fcef9651c2ffe0b5e.tar.xz freeipa.git-df13cdcb974e9f8b161be35fcef9651c2ffe0b5e.zip | |
Forbid public access to DNS tree
With a publicly accessible DNS tree in LDAP, anyone with an access
to the LDAP server can get all DNS data as with a zone transfer
which is already restricted with ACL. Making DNS tree not readable
to public is a common security practice and should be applied
in FreeIPA as well.
This patch adds a new deny rule to forbid access to DNS tree to
users or hosts without an appropriate permission or users which
are not members of admins group. The new permission/aci is
applied both for new installs and upgraded servers.
bind-dyndb-ldap plugin is allowed to read DNS tree without any
change because its principal is already a member of "DNS
Servers" privilege.
https://fedorahosted.org/freeipa/ticket/2569
Diffstat (limited to 'ipalib/plugins/migration.py')
0 files changed, 0 insertions, 0 deletions