Fedora Infrastructure IRC Meeting Log from 2007-07-26

[David Lutterkort]

On Thu, 2007-07-26 at 16:01 -0500, Jeffrey C. Ollie wrote:
> [15:30] mmcgrath: the problem is opening up access but still keeping some of the passwords/keys secure.
> [15:30] mmcgrath: like the web guys don't need access to the buildserver keys.
> [15:30] mmcgrath: and the build guys don't need the fedoraproject.org ssl key.
> [15:30] mmcgrath: that sort of thing

Not sure if you guys know that or not (or if that applies to what you
guys discussed): puppet lets you define filserver modules that are per
node by putting something like

        [private]
        path /some/path/%h
        allow allow 10.8.34.0/24
        
in your fileserver.conf [1] for sensitive per-node data.

When a client now requests 'puppet://server/private/ssh_host_dsa_key'
the fileserver looks for /some/path/CLIENT/ssh_host_dsa_key where CLIENT
is the host name taken from the client's SSL cert's subject [2] - in
other words, even though the fileserve in general is open to any client
with an acceptable SSL cert, to get at files in such a private module,
you must break that client's SSL cert, or find some other way to own a
cert with that client's host name as the subject.

David

[1] http://reductivelabs.com/trac/puppet/wiki/FileServingConfiguration
    look for %h and %H

[2] Make sure that node_name in the puppetmaster's config file is set to
    'cert' - but that's the default anyway. 
    (see http://reductivelabs.com/trac/puppet/wiki/ConfigurationReference)