non-maas managed subnets cannot query maas DNS

[David Britton]

In the landscape cloud installer if a customer adds a network that is not directly managed by MAAS for their instance floating IP range in their cloud -- let's call it a DMZ -- maas rejects DNS queries originating from that network. There is no config option to check/fix in maas itself that I know of. Instead, a transient config file needs to be altered (perhaps a more permanent way of doing this exists, I didn't dig) to add the following:

   allow-recursion { any; };

Seems like step 1 could be to add a checkbox that turns "any" recursion on. And step 2 could be to add an API which offers more specific control of that setting (which landscape could drive).

If you need to split apart into two bugs, let me know, but this is blocker for our current landscape release (at least getting step 1 in)

[James Troup (elmo)]

Please don't add a checkbox to turn any box using MAAS DNS into an open resolver (which is what your 'any' suggestion does). Certainly not without big blinking warnings that this is a bad idea for any machine that's visible to the internet and even then I think it's a really bad idea.

[David Britton (dpb)]

On Thu, Jul 24, 2014 at 10:47:10PM -0000, James Troup wrote:
> Please don't add a checkbox to turn any box using MAAS DNS into an open
> resolver (which is what your 'any' suggestion does). Certainly not
> without big blinking warnings that this is a bad idea for any machine
> that's visible to the internet and even then I think it's a really bad
> idea.

Thanks James -- I think we would need a way to add the floating IP
subnet directly then.

--
David Britton <email address hidden>

[Julian Edwards (julian-edwards)]

I'm not even sure if this is possible, but can you set up a separate bind server that forwards queries to the MAAS one?

[Andreas Hasenack (ahasenack)]

Sure, but that wouldn't be a bug fix.

How about a form where you could add optional networks for an allow-query {}; block in bind's config? Or maybe automatically do that for networks that were defined in MAAS?

[Raphaël Badin (rvb)]

Maybe we could add a template in /etc/maas from which the BIND config would be generated and that you could modify to suit your needs. This would have the advantage of letting a user configure BIND exactly the way he wants it without making this too obvious by adding a button in the UI.

[Julian Edwards (julian-edwards)]

On Friday 25 Jul 2014 12:14:41 you wrote:
> Sure, but that wouldn't be a bug fix.
>
> How about a form where you could add optional networks for an allow-
> query {}; block in bind's config? Or maybe automatically do that for
> networks that were defined in MAAS?

My initial thought was also to do it automatically for networks defined in
MAAS. I think this is the nicest solution.

[David Britton (dpb)]

On Fri, Jul 25, 2014 at 01:22:51PM -0000, Julian Edwards wrote:
>
> My initial thought was also to do it automatically for networks defined in
> MAAS. I think this is the nicest solution.

Yes, this would have been an undestandable requirement and fits in
nicely with the UI that is already there. We actually tried this option
hoping it would work, but quickly found out, it did not yet. :)

--
David Britton <email address hidden>

[Julian Edwards (julian-edwards)]

Ok what we'll do is add all the networks MAAS knows about into the trusted ACL set, and throw this config into named.conf.options:

acl "trusted" {
     N.N.N.N/bits
     ...
     localhost;
     localnets;
 };

allow-query { any; };
allow-recursion { trusted; };
allow-query-cache { trusted; };

[Dean Henrichsmeyer (dean)]

Sounds good, thanks.