<div dir="ltr"><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Lesley Kimmel</b> <span dir="ltr"><<a href="mailto:lesley.j.kimmel@gmail.com">lesley.j.kimmel@gmail.com</a>></span><br>Date: Fri, Feb 12, 2016 at 8:00 AM<br>Subject: Re: [Pulp-list] Pulp (MongoDB) Security Configuration<br>To: Kodiak Firesmith <<a href="mailto:kfiresmith@gmail.com">kfiresmith@gmail.com</a>><br><br><br><div dir="ltr">FYI, here's the steps I took to get a very basic, self-signed SSL configuration in place:<br><br>$ openssl req -new -x509 -days 3650 -nodes -out mongodb-cert.crt -keyout mongodb-cert.key<br>Country Name (2 letter code) [XX]:<br>State or Province Name (full name) []:<br>Locality Name (eg, city) [Default City]:<br>Organization Name (eg, company) [Default Company Ltd]:<br>Organizational Unit Name (eg, section) []:<br>Common Name (eg, your name or your server's hostname) []:mongodb<br>Email Address []:<br>$ cat mongodb-cert.* >> mongodb.pem<br><br>Add 'sslOnNormalPorts = 1' and 'sslPemKeyFile = /etc/ssl/mongodb.pem' to /etc/mongodb.conf<br><br>Add 'ssl: true' and 'verify_ssl: true' to [database] section of /etc/pulp/server.conf<br>BONUS: Because I used 'mongodb' in the certificate above and using 'verify_ssl' in the Pulp configuration Pulp expects it's request to match the returned CN. In order to do this, do the following:<br>-Add 'seeds: mongodb:27017' to the [database] section of /etc/pulp/server.conf<br>-Add 'mongodb' to the '127.0.0.1' line of /etc/hosts<br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 27, 2016 at 4:13 PM, Kodiak Firesmith <span dir="ltr"><<a href="mailto:kfiresmith@gmail.com" target="_blank">kfiresmith@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">I deprioritized that part for now because they are on the same host and wanted to get more practical security components in place first. AD integration is next and we'll see how that goes.</p><div><div> <div class="gmail_quote">On Jan 27, 2016 5:04 PM, "Lesley Kimmel" <<a href="mailto:lesley.j.kimmel@gmail.com" target="_blank">lesley.j.kimmel@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Did you discover the magic to communicate from Pulp to MongoDB over SSL?<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 27, 2016 at 12:52 PM, Kodiak Firesmith <span dir="ltr"><<a href="mailto:kfiresmith@gmail.com" target="_blank">kfiresmith@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I dumped Sat6/Katello in favor of using Pulp for everything we can't already do with our Puppet 4 cluster. The final result should be:<div>* Puppet4 cluster (dns round robin, integrated with R10K)</div><div>* Pulp for all non-Puppet content, including using the "ISO" repo function of Pulp to host Kickstarts for https net booting (since we don't use PXE we don't need cobbler, one less attack surface).</div><div>Next steps now that I'm pulling in <a href="http://cdn.redhat.com" target="_blank">cdn.redhat.com</a> content fine and whatnot are getting internal ssl connections for mongo and qpid, and getting Active Directory integration for pulp activities sorted out. </div><div><br></div><div>Things are really looking up.</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 27, 2016 at 1:45 PM, Lesley Kimmel <span dir="ltr"><<a href="mailto:lesley.j.kimmel@gmail.com" target="_blank">lesley.j.kimmel@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">What kind of overall progress have you made on securing Satellite6/Katello?<br></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 27, 2016 at 12:29 PM, Kodiak Firesmith <span dir="ltr"><<a href="mailto:kfiresmith@gmail.com" target="_blank">kfiresmith@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Lesley,<div>I just had to do this during my setup. Well, part b at least - haven't throttled the # connections.</div><div><br></div><div>Here is what is working for me, YMMV as I'm hardly an expert:</div><div><br></div><div><div>> use pulp_database</div><div>switched to db pulp_database</div><div>> show users</div><div>{</div><div><span style="white-space:pre-wrap"> </span>"_id" : "pulp_database.pulpAdministrator",</div><div><span style="white-space:pre-wrap"> </span>"user" : "pulpAdministrator",</div><div><span style="white-space:pre-wrap"> </span>"db" : "pulp_database",</div><div><span style="white-space:pre-wrap"> </span>"roles" : [</div><div><span style="white-space:pre-wrap"> </span>{</div><div><span style="white-space:pre-wrap"> </span>"role" : "dbAdmin",</div><div><span style="white-space:pre-wrap"> </span>"db" : "pulp_database"</div><div><span style="white-space:pre-wrap"> </span>},</div><div><span style="white-space:pre-wrap"> </span>{</div><div><span style="white-space:pre-wrap"> </span>"role" : "readWrite",</div><div><span style="white-space:pre-wrap"> </span>"db" : "pulp_database"</div><div><span style="white-space:pre-wrap"> </span>}</div><div><span style="white-space:pre-wrap"> </span>]</div><div>}</div></div><div><br></div><div><br></div><div>Hit me up on #pulp if you have any trouble and I'll see if your errors match any of the ones I hit during my struggle to get mongo auth set up :)</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On Wed, Jan 27, 2016 at 1:21 PM, Lesley Kimmel <span dir="ltr"><<a href="mailto:lesley.j.kimmel@gmail.com" target="_blank">lesley.j.kimmel@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr"><div><div><div>All;<br><br></div>I am attempting to secure Satellite/Katello per DoD security guidance. The first few items I need to do is to limit incoming connections and to enable access control. Along those lines can anyone answer:<br><br></div>a) How many connections to MongoDB does Pulp require? Is it configurable?<br></div>b) Out of the box there is no access control between Pulp and MongoDB. What are the minimum permissions/roles needed for a user to allow Pulp do do what it needs to do?<br></div> <br></div></div>_______________________________________________<br> Pulp-list mailing list<br> <a href="mailto:Pulp-list@redhat.com" target="_blank">Pulp-list@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/pulp-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pulp-list</a><br></blockquote></div><br></div> </blockquote></div><br></div> </div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div> </blockquote></div> </div></div></blockquote></div><br></div> </div></div></div><br></div>