freeipa

#9094 Support use of RPZ (Response Policy Zones)
Opened by brianjmurrell. Modified

Open
Close Issue

Request for enhancement

RPZs (Response Policy Zones) can be immensely useful in various scenarios. One very useful scenario is using them to provide network-wide Ad-blocking and tracking mitigation. Ad servers are known for delivering malvertizing and tracking, well, tracking, we all know about the nastiness of that.

They can be supported with current FreeIPA simply by adding:

response-policy {
        zone "rpz.example.com";
};

to the options section of named.conf. The zones themselves are supported by the current zone maintenance functionality of FreeIPA.

Of course, yes, this can be done using /etc/named/ipa-options-ext.conf however that defeats the goal of all configuration in one place and requires that I now handle maintenance and distribution of /etc/named/ipa-options-ext.conf to the replicas manually, outboard of FreeIPA.

That would be a great addition, we are using it currently for a couple of internal services that are exposed over a reverse proxy. We could use NAT reflection, but I feel a small split DNS using RPZ is cleaner.

Any contribution is welcome.

Great! Where should one start when making the first contribution? Should it be discussed before starting with the implementation?

It will likely span two separate projects. https://pagure.io/bind-dyndb-ldap may need to be updated to pull this configuration out of LDAP. And IPA side would need commands to manage this data, tests, etc.

And you likely need to define new LDAP schema to store the value(s).

I don't know a ton about DNS but in situations like this I typically start with storage (schema) needs (multi-valued, data type, etc). Then see what needs to be done in bind-dyndb-ldap so that bind can get at the data. That will inform you on where in the DIT this needs to be stored. It may be possible to store it with other IPA global DNS configuration data like global forwarders, which would be a relatively minor extension I think.

IPA manages an IANA namespace for IPA-specific LDAP objectclasses and attributes. You'll likely need a new attribute to store this, and update the equivalent objectclass. We can help with that.

I'd suggest doing some initial investigation and come up with a plan. We can discuss it on the freeipa-devel mailing list (even for the bind-dyndb-ldap pieces).

General contributor info can be found at https://www.freeipa.org/page/Contribute#Development
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.