Fix DDNS keyfile creation, configuration and writeable zone location

systemli / ansible-role-bind9

Ansible role to install and maintain the Bind9 nameserver on Debian

GNU General Public License v3.0

24 stars 25 forks source link

Fix DDNS keyfile creation, configuration and writeable zone location #59

Closed 0xMattijs closed 1 year ago

0xMattijs commented 1 year ago

Problem

This Ansible role writes zone files to a hard coded /etc/bind/zones directory, which causes problems on systems with mandatory access control such as Apparmor. The profile for Apparmor does not allow the BIND process to create the necessary journal files and update the zone files under /etc/bind/zones.

Solution

Parameterize the zone directory and default to /var/lib/bind/zones, for which write access is allowed by the Apparmor profile.

PR

This PR parameterises the location for storing the zone files. It also includes code to generate DDNS keys using tsig-keygen if a configured update_keyfile does not exist already. Since tsig-keygen generates a full key configuration section, the named.conf.options.j2 template has been adjusted accordingly.

doobry-systemli commented 1 year ago

Dear @0xMattijs, thanks for your contribution!

After a first look I have two comments:

I'd prefer to keep the default path for keys at /etc/bind/keys to not break backwards-compability. Since you make it configurable anyway, I think that should be fine.
The tasks to optionally create a DDNS key result in changes in your local playbook. While I see the advantage of providing code to do so, I don't like this being executed per default. Most setups I know have their Ansible playbook in a Git repository and altering that while deploying is unexecpted behaviour in my eyes. Maybe instead it would be an option to run the tasks only if a variable is set to true (e.g. with ansible-playbook ... -e 'bind9_generate_ddns_key=true') and document that behaviour in README.md? What do you think about that approach?

0xMattijs commented 1 year ago

Hi @doobry-systemli . Totally makes sense. I have processed your suggestions in the PR:

Make generating keys optional with bind9_generate_ddns_key
Adjusted the default zone DB location back to /etc/bind/zones
Adjusted the default key storage location to files/bind/zones within the playbook (the location where the role expects them when provided by the user)
Updated the README