Tighten permissions on zone keys

Remove world-readable/traversable bits from permissions on the BIND
DNSSEC keys directory and the keys themselves (not actually
necessary for the public key files, but added for consistency as
they share a directory with the private keys). Note that this
matches the permissions and ownership of the existing
adns1.openstack.org server.

Change-Id: I015777ee346fefcaa92e64ad2ee88a41c7ea9bde

playbooks/roles/master-nameserver/tasks/main.yaml

@@ -46,17 +46,26 @@
   file:
     path: "/etc/bind/keys/{{ item.name }}"
     state: directory
+    owner: root
+    group: bind
+    mode: 0750
 - name: Install dnssec public keys
   loop: "{{ dnssec_keys | dict2items }}"
   copy:
     dest: "/etc/bind/keys/{{ item.value.zone }}/K{{ item.value.zone }}.+008+{{ item.key }}.key"
     content: "{{ item.value.public }}"
+    owner: root
+    group: bind
+    mode: 0440
 - name: Install dnssec private keys
   no_log: true
   loop: "{{ dnssec_keys | dict2items }}"
   copy:
     dest: "/etc/bind/keys/{{ item.value.zone }}/K{{ item.value.zone }}.+008+{{ item.key }}.private"
     content: "{{ item.value.private }}"
+    owner: root
+    group: bind
+    mode: 0440
 - name: Install bind config
   template:
     src: templates/named.conf.j2