[Freeipa-users] Changing allow-recursion in named.conf - issues / gotchas ?

[Jonathan Vaughn]

We have a use case for letting the FreeIPA named instances handle public
DNS for some zones, but we don't want them to allow anyone to use it as a
recursive resolver (DOS attacks and such).

I tested simply changing 'any' to 'none' for the allow-recursion setting
in
/etc/named.conf and that worked as expected - the next step being to
actually set it like we have our existing non-IPA servers configured to
allow only internal/known public subnets to perform recrusion, which I
expect will work as well (using a named ACL instead of none/any).

Is there a nice UI way (or command line) to change the allow-recursion
setting in way that is more in line with the usual management of settings
for FreeIPA, and would ensure it wouldn't get overwritten at some point by
FreeIPA? Is that even a concern, or should we expect that /etc/named.conf
is going to be safe from changes due to anything like adding/removing
replicas and so on (looks like that may all be in LDAP)?