<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 04/09/2014 11:58 AM, Andy Tomlin wrote: </div> <blockquote cite="mid:CAF4MyDZ-RF3HpeeTk0DGGosDpUaXLPw-mE-v-e0d9e0JYpjoVQ@mail.gmail.com" type="cite"> <div dir="ltr">Ok, I added a howto page</div> </blockquote> Thanks Martin, should be link it from HowTo page? <blockquote cite="mid:CAF4MyDZ-RF3HpeeTk0DGGosDpUaXLPw-mE-v-e0d9e0JYpjoVQ@mail.gmail.com" type="cite"> <div class="gmail_extra"> <div class="gmail_quote">On Fri, Apr 4, 2014 at 5:51 PM, Andy Tomlin <<a moz-do-not-send="true" href="mailto:atomlin@engineer.com" target="_blank">atomlin@engineer.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Remove foot from mouth... sure. <div class="HOEnZb"> <div class="h5"> -----Original Message----- From: <a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [mailto:<a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>] On Behalf Of Dmitri Pal Sent: Friday, April 4, 2014 4:45 PM To: <a moz-do-not-send="true" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] DDNS with DHCPD and IPA On 04/03/2014 07:50 PM, Andy Tomlin wrote: > Awesome, adding the grant line with my key (DDNS_UPDATE) did the > trick. This makes it perform exactly like old config. > > Thanks for the help. Someone should put this example in the docs. Would you mind writing a HowTo on our wiki? > > -----Original Message----- > From: <a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> > [mailto:<a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>] On Behalf Of William Brown > Sent: Thursday, April 3, 2014 3:29 PM > To: <a moz-do-not-send="true" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> > Subject: Re: [Freeipa-users] DDNS with DHCPD and IPA > > On Thu, 2014-04-03 at 11:02 -0700, Andy Tomlin wrote: >> That would be my preference, would then work same as bind/dhcpd >> before switching to ipa. I just dont know how to do it correctly. >> >> > This assumes dhcp and named are on the same system. > > For an unrelated project I wrote some docs here: > > <a moz-do-not-send="true" href="http://tollgate.readthedocs.org/en/3.0.1/fedora-deploy.html#core-netwo" target="_blank">http://tollgate.readthedocs.org/en/3.0.1/fedora-deploy.html#core-netwo</a> > rk > > And the example config files referenced are: > > <a moz-do-not-send="true" href="https://github.com/micolous/tollgate/tree/master/docs/example/fedora" target="_blank">https://github.com/micolous/tollgate/tree/master/docs/example/fedora</a> > > The important parts are: > > rndc-confgen -a -r keyboard -b 256 > chown named:named /etc/rndc.key > > In named.conf add after the options section: > > include "/etc/rndc.key"; > > In the zone (In ipa you will need to add this permission) > > grant rndc-key wildcard * ANY; > > Then in dhcpd: > > > include "/etc/rndc.key"; > > And to the dhcpd range: > > > zone dhcp.example.lan. { > primary 127.0.0.1; > key "rndc-key"; > } > > > zone 0.4.10.in-addr.arpa. { > primary 127.0.0.1; > key "rndc-key"; > } > > > This should coexist peacefully with freeipa, but try to make sure your > DDNS updated zone is say <a moz-do-not-send="true" href="http://dhcp.example.com" target="_blank">dhcp.example.com</a> rather than a zone you care about. > Consider you have a domain controller called <a moz-do-not-send="true" href="http://x.example.com" target="_blank">x.example.com</a>, and you > allow DDNS to <a moz-do-not-send="true" href="http://example.com" target="_blank">example.com</a>. If someone set their hostname to x, they > could take over the DNS records for your DC. Better to have a second > zone to prevent this. > > -- > William Brown <<a moz-do-not-send="true" href="mailto:william@firstyear.id.au">william@firstyear.id.au</a>> > > _______________________________________________ > Freeipa-users mailing list > <a moz-do-not-send="true" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> > <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > > _______________________________________________ > Freeipa-users mailing list > <a moz-do-not-send="true" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> > <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> -- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc. _______________________________________________ Freeipa-users mailing list <a moz-do-not-send="true" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </div> </div> </blockquote> </div> </div> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc.</pre> </body> </html>