How to restrict FreeIPA's from registering external IPs on DNS?

[Vinícius Ferrão]

Hello,

My FreeIPA server have two IP addresses. It registers itself with the internal and the
external addresses. There’s a way to only register the IPs from the internal interfaces?

Example:


ipa-ca
A
172.26.255.254
A
146.164.29.90


nodacabeca
A
146.164.29.90
A
172.26.255.254

I only want the entries from the network 172.26.0.0/16.

Thanks,
V.

[Natxo Asenjo]

hi Vinícius,


On Fri, Feb 7, 2020 at 9:29 PM Vinícius Ferrão via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  Hello,
>
>  My FreeIPA server have two IP addresses. It registers itself with the
>  internal and the external addresses. There’s a way to only register the IPs
>  from the internal interfaces?
>  
usually those ip addresses are tied to specific network interfaces (eth0,
ens192, tun0, whatever). You can tell sssd to use only those interfaces to
register its dyndns (details in man sssd-ipa, look for dyndns_iface
directive)

dyndns_iface (string)
           Optional. Applicable only when dyndns_update is true. Choose the
           interface or a list of interfaces whose IP addresses should be
used
           for dynamic DNS updates. Special value “*” implies that IPs from
           all interfaces should be used.

           NOTE: While it is still possible to use the old ipa_dyndns_iface
           option, users should migrate to using dyndns_iface in their
config
           file.

           Default: Use the IP addresses of the interface which is used for
           IPA LDAP connection

           Example: dyndns_iface = em1, vnet1, vnet2

Regards,
Natxo

[Vinícius Ferrão]

Natxo thank you. I will look at this on the machines joining the domain.

Do you know any workaround during the IPA server install?

Thanks,

On 9 Feb 2020, at 07:06, Natxo Asenjo via FreeIPA-users
<[e-mail]<mailto:[e-mail]>>
wrote:

hi Vinícius,


On Fri, Feb 7, 2020 at 9:29 PM Vinícius Ferrão via FreeIPA-users
<[e-mail]<mailto:[e-mail]>>
wrote:
Hello,

My FreeIPA server have two IP addresses. It registers itself with the internal and the
external addresses. There’s a way to only register the IPs from the internal interfaces?

usually those ip addresses are tied to specific network interfaces (eth0, ens192, tun0,
whatever). You can tell sssd to use only those interfaces to register its dyndns (details
in man sssd-ipa, look for dyndns_iface directive)

dyndns_iface (string)
           Optional. Applicable only when dyndns_update is true. Choose the
           interface or a list of interfaces whose IP addresses should be used
           for dynamic DNS updates. Special value “*” implies that IPs from
           all interfaces should be used.

           NOTE: While it is still possible to use the old ipa_dyndns_iface
           option, users should migrate to using dyndns_iface in their config
           file.

           Default: Use the IP addresses of the interface which is used for
           IPA LDAP connection

           Example: dyndns_iface = em1, vnet1, vnet2

Regards,
Natxo

_______________________________________________
FreeIPA-users mailing list --
[e-mail]<mailto:[e-mail]>
To unsubscribe send an email to
[e-mail]<mailto:[e-mail]>
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...