summaryrefslogtreecommitdiffstats
path: root/install/tools/ipa-upgradeconfig
diff options
context:
space:
mode:
authorMartin Kosek <mkosek@redhat.com>2012-06-28 16:46:48 +0200
committerMartin Kosek <mkosek@redhat.com>2012-07-13 16:03:58 +0200
commit9d69db80a3d1fc46236a4546988176cdd7939b82 (patch)
tree345e5ba63fe447b151377df1bda42475e3cb8160 /install/tools/ipa-upgradeconfig
parent4879c68d68634715b9d08a08a4c7be882634409f (diff)
downloadfreeipa-9d69db80a3d1fc46236a4546988176cdd7939b82.tar.gz
freeipa-9d69db80a3d1fc46236a4546988176cdd7939b82.tar.xz
freeipa-9d69db80a3d1fc46236a4546988176cdd7939b82.zip
Enable SOA serial autoincrement
SOA serial autoincrement is a requirement for major DNS features, e.g. zone transfers or DNSSEC. Enable it by default in named.conf both for new and upgraded installations. Name of the bind-dyndb-ldap option is "serial_autoincrement". From now on, idnsSOAserial attribute also has to be put to replication agreement exclude list as serial will be incremented on each DNS server separately and won't be shared. Exclude list has to be updated both for new replication agreements and the current ones. Minimum number of connections for bind-dyndb-ldap has been rised to 4 connections, the setting will be updated during package upgrade. https://fedorahosted.org/freeipa/ticket/2554
Diffstat (limited to 'install/tools/ipa-upgradeconfig')
-rw-r--r--install/tools/ipa-upgradeconfig68
1 files changed, 63 insertions, 5 deletions
diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig
index 248232ac6..b82f039d4 100644
--- a/install/tools/ipa-upgradeconfig
+++ b/install/tools/ipa-upgradeconfig
@@ -302,7 +302,7 @@ def upgrade_httpd_selinux(fstore):
http = httpinstance.HTTPInstance(fstore)
http.configure_selinux_for_httpd()
-def enable_psearch_for_named():
+def named_enable_psearch():
"""
From IPA 3.0, persistent search is a preferred mechanism for new DNS zone
detection and is also needed for other features (DNSSEC, SOA serial
@@ -322,11 +322,13 @@ def enable_psearch_for_named():
return
try:
- psearch = bindinstance.named_conf_get_directive('psearch').lower()
+ psearch = bindinstance.named_conf_get_directive('psearch')
except IOError, e:
root_logger.debug('Cannot retrieve psearch option from %s: %s',
bindinstance.NAMED_CONF, e)
return
+ else:
+ psearch = None if psearch is None else psearch.lower()
if not sysupgrade.get_upgrade_state('named.conf', 'psearch_enabled'):
if psearch != "yes":
try:
@@ -343,7 +345,8 @@ def enable_psearch_for_named():
# make sure number of connections is right
minimum_connections = 2
if psearch == 'yes':
- minimum_connections = 3
+ # serial_autoincrement increased the minimal number of connections to 4
+ minimum_connections = 4
try:
connections = bindinstance.named_conf_get_directive('connections')
except IOError, e:
@@ -373,6 +376,59 @@ def enable_psearch_for_named():
root_logger.debug('No changes made')
return changed
+def named_enable_serial_autoincrement():
+ """
+ Serial autoincrement is a requirement for zone transfers or DNSSEC. It
+ should be enabled both for new installs and upgraded servers.
+
+ When some change in named.conf is done, this functions returns True
+ """
+ changed = False
+
+ root_logger.info('[Enabling serial autoincrement in DNS]')
+
+ if not bindinstance.named_conf_exists():
+ # DNS service may not be configured
+ root_logger.debug('DNS not configured')
+ return changed
+
+ try:
+ psearch = bindinstance.named_conf_get_directive('psearch')
+ serial_autoincrement = bindinstance.named_conf_get_directive(
+ 'serial_autoincrement')
+ except IOError, e:
+ root_logger.debug('Cannot retrieve psearch option from %s: %s',
+ bindinstance.NAMED_CONF, e)
+ return changed
+ else:
+ psearch = None if psearch is None else psearch.lower()
+ serial_autoincrement = None if serial_autoincrement is None \
+ else serial_autoincrement.lower()
+
+ # enable SOA serial autoincrement
+ if not sysupgrade.get_upgrade_state('named.conf', 'autoincrement_enabled'):
+ if psearch != "yes": # psearch is required
+ root_logger.debug('Persistent search is disabled, '
+ 'serial autoincrement cannot be enabled')
+ else:
+ if serial_autoincrement != 'yes':
+ try:
+ bindinstance.named_conf_set_directive('serial_autoincrement', 'yes')
+ except IOError, e:
+ root_logger.error('Cannot enable serial_autoincrement in %s: %s',
+ bindinstance.NAMED_CONF, e)
+ return changed
+ else:
+ root_logger.debug('Serial autoincrement enabled')
+ changed = True
+ else:
+ root_logger.debug('Serial autoincrement is alredy enabled')
+ sysupgrade.set_upgrade_state('named.conf', 'autoincrement_enabled', True)
+ else:
+ root_logger.debug('Skip serial autoincrement check')
+
+ return changed
+
def main():
"""
Get some basics about the system. If getting those basics fail then
@@ -435,9 +491,11 @@ def main():
cleanup_kdc(fstore)
upgrade_ipa_profile(krbctx.default_realm)
- changed = enable_psearch_for_named()
- if changed:
+ changed_psearch = named_enable_psearch()
+ changed_autoincrement = named_enable_serial_autoincrement()
+ if changed_psearch or changed_autoincrement:
# configuration has changed, restart the name server
+ root_logger.info('Changes to named.conf have been made, restart named')
bindinstance.BindInstance(fstore).restart()
if __name__ == '__main__':