From Fedora Project Wiki
(Current status: postponed to Fedora 21)
(Postponed to next Fedora)
Line 142: Line 142:
'''To be completed by the Change Freeze!'''
'''To be completed by the Change Freeze!'''
<!-- [[Category:ChangePageIncomplete]] -->
<!-- [[Category:ChangePageIncomplete]] -->
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- When your change proposal page is completed and ready for review and announcement -->

Revision as of 14:30, 5 November 2013

DNSSEC support for FreeIPA


FreeIPA with integrated DNS server will support serving of DNSSEC secured zones.


  • Name: Petr Špaček
  • Email:
  • Release notes owner: <To be assigned by docs team>

Current status

  • Targeted release: Fedora 21 This feature was re-targeted to Fedora 21!
  • Last updated: 2013-10-17
  • Tracker bug: #998522
  • 2013-08-16: It is possible that user interface and encryption key rotation mechanism will not be finished in time for Fedora 20. In that case, the feature will stay hidden and disabled.
  • 2013-10-17: Some time ago we decided to postpone this feature to Fedora 21.

Detailed Description

DNS server integrated to FreeIPA in Fedora 19 is not able to serve signed DNS zones. New version of FreeIPA and bind-dyndb-ldap adds support for DNSSEC. Zone maintenance (like perioding zone re-signing etc.) will be handled automatically, so the administrative overhead should be minimal.

Benefit to Fedora

Environments with FreeIPA server with integrated DNS will be resilient against DNS spoofing attacks if DNSSEC support if enabled and configured.


This change will require major rewrite of bind-dyndb-ldap package and some isolated changes in packages freeipa*.

  • Other developers: FreeIPA team has to prepare user interface for this feature. (not a System Wide Change)
  • Release engineering: N/A (not a System Wide Change)
  • Policies and guidelines: N/A (not a System Wide Change)

Upgrade/compatibility impact

DNS zones created with older version of FreeIPA/bind-dyndb-ldap will continue to work. User has to generate/provide DNSSEC encryption keys for each zone before enabling this feature.

How To Test

  1. Use FreeIPA's user interface to create a DNS zone (e.g. example.test.).
  2. Generate new DNSSEC keys for the DNS zone.
  3. User has to put DS records to parent DNS zone (e.g. test.).
  4. Now all standard DNSSEC utilities can be used for signature validation. E.g.

User Experience

FreeIPA's user interface will be extended. New options will offer DNSSEC key management for each DNS zone.


FreeIPA packages have to be updated to provide user interface for DNSSEC key management etc. Required changes should be relatively small and isolated. Feature owner is member of FreeIPA team so coordination should be relatively simple.

Contingency Plan

  • Contingency mechanism: Do not expose new feature in FreeIPA's user interface (i.e. revert patches for user interface)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? No


Release Notes

To be completed by the Change Freeze!