Feature Add: update-policy + tsig keys + dynamic updates #177
Conversation
|
when merged? |
Hi, @brunobenchimol |
Hello @mikysal78. Check on how to use tsig keys: https://github.com/brunobenchimol/ansible-role-bind#using-tsig-keys-for-dynamic-updates Its about the same as dns keys, same syntax. update_policy is the same as bind documentation.... about integration with certbot i did a PR (not merged) and i did a wrapper for that. Pull Request on certbot: geerlingguy/ansible-role-certbot#163 Wrapper i built: https://github.com/brunobenchimol/ansible-role-certbot-dns and module on ansible-galaxy - https://galaxy.ansible.com/brunobenchimol/certbot_dns Hope it helps. |
|
@brunobenchimol i try your repo and i have this error: |
Somehow the config is wrong, its picking up managed-keys.bind as zone name and is unable to sync. Double check your yaml files and post to make it easier to troubleshoot. |
|
My playbook is: Zone is (3 zones equal): |
|
I believe you are missing some vars to use my PR. That may break, but i believe you found a bug. on my code tasks/zones.yml on task "- name: Find zones which in need of flushing/dumping dynamic updates to zonefile" i should check if tsig keys are defined, if they are not it may fail to sync/flush zones. Well, regarding to that you are missing some key vars: on your vars you need to create a tsig key: on your zone you need to add update_policy Try to follow this documentation: https://github.com/brunobenchimol/ansible-role-bind#using-tsig-keys-for-dynamic-updates If i remember you must also define a bind key (https://github.com/brunobenchimol/ansible-role-bind#binding-keys)... i am not quite sure but if you do not it wont enable configs that must be done. If you cant make it run, let me know. I will try to set up a lab to test it but it would take some time. |
|
@brunobenchimol i try and i have this error: It seems like it can't read the yml files of the zones, i use the zones in separate files (order in the zones, I don't understand why in the master they put everything together which is confusing). if you want to try my playbook email me and I will send you the files. (mikysal78 @ gmail.com) |
|
@mikysal78 I did not test multiples zones when testing this role. Try to test only one zone than try adding more zones to your yaml file. I believe something is wrong. Check your error: 'tsig_key' is undefined Variable is bind_tsig_key as per documentation. https://github.com/brunobenchimol/ansible-role-bind#using-tsig-keys-for-dynamic-updates Does your config works without using my PR? This PR, only adds two new variables: |
I can't remove the zone, the server is in production
ok, i fix vars bat i have first error:
yes
|
|
@mikysal78 I will post an example i did that worked. I tested with RHEL. Its only one zone by the way. I also advice to set up a testbox for testing new things out. It is not recommended to try new things directly on production systems. |
@brunobenchimol ,Hi, i compress file bind and zones genrate. This on generate from master roles |
|
@mikysal78 i did a small fix on code, hope it fix your error. I changed how ansible read zone files (it will read from your config instead of server files). Commit 0daf9d4 |
update role and now is: the command: i try with DH because HMAC-SHA256 not found: |
|
@mikysal78 Thats quite Debian-related. I am more a RHEL guy. But checking Debians docs https://manpages.debian.org/bullseye/bind9-utils/dnssec-keygen.8.en.html For TSIG keys, it must be generated with HMAC algorithms. According to this manpages you should try tsig-keygen. Check: https://manpages.debian.org/bullseye/bind9/tsig-keygen.8.en.html Always check man pages if help command does not seems complete. |
ok, i generate key with tsig-keygen. |
|
Thays wierd. Thia PR does not touch this part of original code. I cant replicate your exact error. I Will try to help. Upload your named.conf (original) After that check the New files created to compare. Also use named-checkconf and see output. Should have no errors. I believe your bind version is incompatible with some params. New version maybe |
try and with default vars " bind_dnssec_enable: true" with master i not have error, with your role i have error. not write file for check diff. |
|
With the new commits is perfect! |
|
@bertvv You need to see and testing this PR! |
|
Hey @brunobenchimol, I like your PR and need the ability to use dynamic DNS updates. And then I discovered an issue: TASK [bind : Dump/flush dynamic zone changes to disk/zone file] *************************************************************************************************************************************
failed: [ns.local] (item={'name': 'ddns.ns.local', 'create_reverse_zones': False, 'primaries': ['127.0.0.1'], 'type': 'primary', 'name_servers': ['localhost.'], 'update_policy': ['grant clt1 zonesub
A', 'grant clt0 zonesub AAAA', 'grant clt1 zonesub A', 'grant clt1 zonesub AAAA', 'grant clt2 zonesub A', 'grant clt2 zonesub AAAA', 'grant clt3 zonesub A', 'grant clt3 zonesub AAAA']}) => changed=true
ansible_loop_var: item
cmd:
- rndc
- sync
- -clean
- ddns.ns.local
item:
create_reverse_zones: false
name: ddns.ns.local
name_servers:
- localhost.
primaries:
- 127.0.0.1
type: primary
update_policy:
- grant clt0 zonesub A
- grant clt0 zonesub AAAA
- grant clt1 zonesub A
- grant clt1 zonesub AAAA
- grant clt2 zonesub A
- grant clt2 zonesub AAAA
- grant clt3 zonesub A
- grant clt3 zonesub AAAA
msg: non-zero return code
rc: 1
stderr: |-
rndc: 'sync' failed: not found
no matching zone 'ddns.ns.local' in any view
stderr_lines: <omitted>
stdout: ''
stdout_lines: <omitted>This NEW DNS zone needs to be crated - it does not exist. I got into this situation like so: bind_zones:
- name: 'ddns.ns.local'
create_reverse_zones: False
primaries:
- '127.0.0.1'
type: 'primary'
name_servers:
- "localhost."
update_policy:
- "grant {{ bind_tsig_keys[0].name }} zonesub A"
- "grant {{ bind_tsig_keys[0].name }} zonesub AAAA"
- "grant {{ bind_tsig_keys[1].name }} zonesub A"
- "grant {{ bind_tsig_keys[1].name }} zonesub AAAA"
- "grant {{ bind_tsig_keys[2].name }} zonesub A"
- "grant {{ bind_tsig_keys[2].name }} zonesub AAAA"
- "grant {{ bind_tsig_keys[3].name }} zonesub A"
- "grant {{ bind_tsig_keys[3].name }} zonesub AAAA"and then: bind_zones:
- name: 'ddns.ns.local'
create_forward_zones: False # <---- note this "FORWARD": ``named.conf`` does not include this zone
primaries:
- '127.0.0.1'
type: 'primary'
name_servers:
- "localhost."
update_policy:
- "grant {{ bind_tsig_keys[0].name }} zonesub A"
- "grant {{ bind_tsig_keys[0].name }} zonesub AAAA"
- "grant {{ bind_tsig_keys[1].name }} zonesub A"
- "grant {{ bind_tsig_keys[1].name }} zonesub AAAA"
- "grant {{ bind_tsig_keys[2].name }} zonesub A"
- "grant {{ bind_tsig_keys[2].name }} zonesub AAAA"
- "grant {{ bind_tsig_keys[3].name }} zonesub A"
- "grant {{ bind_tsig_keys[3].name }} zonesub AAAA"After that I replaced I tried this Is there a way to:
EDIT1:
|
|
Hello @Kariton
That is not based on my PR, but if i remember properly it needs to maintain all zones when using this role.
Flush is based on dynamic dns policies (update policy/allow updates)... if it has on config, it will sync flush. I could not find anyway to preserve previous dynamic updates and change bind files.... either dynamic goes away or new zone file does not get loaded. Maybe, thats big one..it could be able to create a new variable to control when to sync flush zones. But it may lead to inconsistent state. So if i got it properly, you are having issues on the first run of this role because it crashes because there is nothing to flush yet? Could try to implement to check if zone file exists before running sync. I did a few changes on my previous commit https://github.com/brunobenchimol/ansible-role-bind/blob/master/tasks/zones.yml... i dont know if it "updated" this PR when i was fixing some bugs for @mikysal78 . |
|
Another one: |
|
Hello @brunobenchimol,
yep. I have read your discussion with @mikysal78.
I thought about it a bit and also found nothing better. From my understanding:
It did. |
| @@ -0,0 +1,7 @@ | |||
| // {{ ansible_managed }} | |||
There was a problem hiding this comment.
And you should replace this row with {{ ansible_managed | comment('c') }}
This is the way to go to enable multi-line ansible_managed
|
I was thinking on checking it using |
Added the ability to use bind_tsig_keys to use with dynamics updates (useful cases: DHCP integration and Certbot DNS challenge automation).
Changed documentation to explain how to use. Also added and changed templates to implement this feature.
Changelog was not touched.