Feature #39: Node Authentication - Foreman

Custom queries

3.11.5 release DONE
3.11.5 release TODO
3.12.2 release DONE
3.12.2 release TODO
3.13.0 release DONE
3.13.0 release TODO
All bugs by votes
All issues closed in the last 3 weeks
Easy and Trivial Issues
Easy Issues (only)
Foreman - new open issues in last 10 days
Good first issues - Foreman core
high prio open bugs
Host registration [open]
Mine
My issues closed in the last 3 weeks
old bugs
Open with target version set (aka blockers)
registration
taken-none
Team Atlas untriaged bugs
templates
Trivial Issues
Untriaged and opened in the past two weeks

Actions

Copy link

Feature #39

closed

Node Authentication

Added by Carl Caum about 15 years ago. Updated about 12 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Carl Caum

Category:

External Nodes

Target version:

Difficulty:

Triaged:

Bugzilla link:

Pull request:

Fixed in Releases:

Found in Releases:

Red Hat JIRA:

Description

We need the ability to authenticate nodes before serving an external nodes request. One box should not be allowed to access the parameters and classes of another. Parameters can potentially contain sensitive information.

History
Notes
Property changes
Associated revisions

Actions

Copy link

Updated by Ohad Levy about 15 years ago

Do you mean the external node lookup script, the web interface YAML link or both?

how would you want to restrict it? based on hostnames?

Actions

Copy link

Updated by Carl Caum about 15 years ago

The external node lookup script. I think we should use certs. We could just use puppetca.

What gets tricky is puppetmasterless environments. We'll need some sort of differentiation between puppetmasters and node requests. A puppetmaster should be able to make requests for any node, but a node should only be able to make requests for itself.

Actions

Copy link

Updated by Ohad Levy about 15 years ago

Carl Caum wrote:

The external node lookup script. I think we should use certs. We could just use puppetca.

What gets tricky is puppetmasterless environments. We'll need some sort of differentiation between puppetmasters and node requests. A puppetmaster should be able to make requests for any node, but a node should only be able to make requests for itself.

if you just want plain SSL authentication, that you would need to use passenger / mongrel and enforce the SSL verification.
this will allow any puppet signed certificate to contact foreman.

this will only solve your case (where you are running without a puppetmaster), maybe we still need an allowed host list where the puppetmasters can be verified.

Actions

Copy link