Skip to content

Commit ed371ce

Browse files
kbarberkbarber
committed
Merge pull request #215 from michaelweiser/qr2
Restrict access to the Puppet master by default
2 parents eea0a30 + 3889cc5 commit ed371ce

7 files changed

Lines changed: 135 additions & 13 deletions

File tree

‎README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -668,6 +668,14 @@ Defaults to `undef`, using the PuppetDB built-in default.
668668
The amount of disk space (in MB) to allow for temporary message storage.
669669
Defaults to `undef`, using the PuppetDB built-in default.
670670

671+
####`certificate_whitelist_file`
672+
673+
The name of the certificate whitelist file to set up and configure in PuppetDB. Defaults to `/etc/puppetdb/certificate-whitelist` or `/etc/puppetlabs/puppetdb/certificate-whitelist` for FOSS and PE respectively.
674+
675+
####`certificate_whitelist`
676+
677+
Array of the X.509 certificate Common Names of clients allowed to connect to PuppetDB. Defaults to empty. Be aware that this permits full access to all Puppet clients to download anything contained in PuppetDB, including the full catalogs of all nodes, which possibly contain sensitive information. Set to `[ $::servername ]` to allow access only from your (single) Puppet master, which is enough for normal operation. Set to a list of Puppet masters if you have multiple.
678+
671679

672680
### puppetdb::server
673681

‎manifests/init.pp‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,9 @@
6666
$max_threads = $puppetdb::params::max_threads,
6767
$command_threads = $puppetdb::params::command_threads,
6868
$store_usage = $puppetdb::params::store_usage,
69-
$temp_usage = $puppetdb::params::temp_usage
69+
$temp_usage = $puppetdb::params::temp_usage,
70+
$certificate_whitelist_file = $puppetdb::params::certificate_whitelist_file,
71+
$certificate_whitelist = $puppetdb::params::certificate_whitelist,
7072
) inherits puppetdb::params {
7173

7274
class { '::puppetdb::server':
@@ -132,6 +134,8 @@
132134
command_threads => $command_threads,
133135
store_usage => $store_usage,
134136
temp_usage => $temp_usage,
137+
certificate_whitelist_file => $certificate_whitelist_file,
138+
certificate_whitelist => $certificate_whitelist,
135139
}
136140

137141
if ($database == 'postgres') {

‎manifests/params.pp‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -71,28 +71,25 @@
7171
if !($puppetdb_version in ['latest','present','absent']) and versioncmp($puppetdb_version, '3.0.0') < 0 {
7272
case $::osfamily {
7373
'RedHat', 'Suse', 'Archlinux','Debian': {
74-
$confdir = '/etc/puppetdb/conf.d'
74+
$etcdir = '/etc/puppetdb'
7575
$vardir = '/var/lib/puppetdb'
7676
$database_embedded_path = "${vardir}/db/db"
7777
$puppet_confdir = pick($settings::confdir,'/etc/puppet')
7878
$puppet_service_name = 'puppetmaster'
79-
$ssl_dir = '/etc/puppetdb/ssl'
8079
}
8180
'OpenBSD': {
82-
$confdir = '/etc/puppetdb/conf.d'
81+
$etcdir = '/etc/puppetdb'
8382
$vardir = '/var/db/puppetdb'
8483
$database_embedded_path = "${vardir}/db/db"
8584
$puppet_confdir = pick($settings::confdir,'/etc/puppet')
8685
$puppet_service_name = 'puppetmasterd'
87-
$ssl_dir = '/etc/puppetdb/ssl'
8886
}
8987
'FreeBSD': {
90-
$confdir = '/usr/local/etc/puppetdb/conf.d'
88+
$etcdir = '/usr/local/etc/puppetdb'
9189
$vardir = '/var/db/puppetdb'
9290
$database_embedded_path = "${vardir}/db/db"
9391
$puppet_confdir = pick($settings::confdir,'/usr/local/etc/puppet')
9492
$puppet_service_name = 'puppetmaster'
95-
$ssl_dir = '/usr/local/etc/puppetdb/ssl'
9693
}
9794
default: {
9895
fail("The fact 'osfamily' is set to ${::osfamily} which is not supported by the puppetdb module.")
@@ -103,22 +100,19 @@
103100
} else {
104101
case $::osfamily {
105102
'RedHat', 'Suse', 'Archlinux','Debian': {
106-
$confdir = '/etc/puppetlabs/puppetdb/conf.d'
103+
$etcdir = '/etc/puppetlabs/puppetdb'
107104
$puppet_confdir = pick($settings::confdir,'/etc/puppetlabs/puppet')
108105
$puppet_service_name = 'puppetserver'
109-
$ssl_dir = '/etc/puppetlabs/puppetdb/ssl'
110106
}
111107
'OpenBSD': {
112-
$confdir = '/etc/puppetlabs/puppetdb/conf.d'
108+
$etcdir = '/etc/puppetlabs/puppetdb'
113109
$puppet_confdir = pick($settings::confdir,'/etc/puppetlabs/puppet')
114110
$puppet_service_name = undef
115-
$ssl_dir = '/etc/puppetlabs/puppetdb/ssl'
116111
}
117112
'FreeBSD': {
118-
$confdir = '/usr/local/etc/puppetlabs/puppetdb/conf.d'
113+
$etcdir = '/usr/local/etc/puppetlabs/puppetdb'
119114
$puppet_confdir = pick($settings::confdir,'/usr/local/etc/puppetlabs/puppet')
120115
$puppet_service_name = undef
121-
$ssl_dir = '/usr/local/etc/puppetlabs/puppetdb/ssl'
122116
}
123117
default: {
124118
fail("The fact 'osfamily' is set to ${::osfamily} which is not supported by the puppetdb module.")
@@ -130,6 +124,9 @@
130124
$database_embedded_path = "${vardir}/db/db"
131125
}
132126

127+
$confdir = "${etcdir}/conf.d"
128+
$ssl_dir = "${etcdir}/ssl"
129+
133130
case $::osfamily {
134131
'RedHat', 'Suse', 'Archlinux': {
135132
$puppetdb_initconf = '/etc/sysconfig/puppetdb'
@@ -161,4 +158,10 @@
161158
$ssl_key = undef
162159
$ssl_cert = undef
163160
$ssl_ca_cert = undef
161+
162+
$certificate_whitelist_file = "${etcdir}/certificate-whitelist"
163+
# the default is free access for now
164+
$certificate_whitelist = [ ]
165+
# change to this to only allow access by the puppet master by default:
166+
#$certificate_whitelist = [ $::servername ]
164167
}

‎manifests/server.pp‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@
6262
$command_threads = $puppetdb::params::command_threads,
6363
$store_usage = $puppetdb::params::store_usage,
6464
$temp_usage = $puppetdb::params::temp_usage,
65+
$certificate_whitelist_file = $puppetdb::params::certificate_whitelist_file,
66+
$certificate_whitelist = $puppetdb::params::certificate_whitelist,
6567
) inherits puppetdb::params {
6668
# deprecation warnings
6769
if $database_ssl != undef {
@@ -238,6 +240,13 @@
238240
notify => Service[$puppetdb_service],
239241
}
240242

243+
class { 'puppetdb::server::puppetdb':
244+
certificate_whitelist_file => $certificate_whitelist_file,
245+
certificate_whitelist => $certificate_whitelist,
246+
confdir => $confdir,
247+
notify => Service[$puppetdb_service],
248+
}
249+
241250
if !empty($java_args) {
242251
if $merge_default_java_args {
243252
create_resources(
@@ -277,13 +286,15 @@
277286
Class['puppetdb::server::database'] ->
278287
Class['puppetdb::server::read_database'] ->
279288
Class['puppetdb::server::jetty'] ->
289+
Class['puppetdb::server::puppetdb'] ->
280290
Service[$puppetdb_service]
281291
} else {
282292
Package[$puppetdb_package] ->
283293
Class['puppetdb::server::command_processing'] ->
284294
Class['puppetdb::server::database'] ->
285295
Class['puppetdb::server::read_database'] ->
286296
Class['puppetdb::server::jetty'] ->
297+
Class['puppetdb::server::puppetdb'] ->
287298
Service[$puppetdb_service]
288299
}
289300
}

‎manifests/server/puppetdb.pp‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# PRIVATE CLASS - do not use directly
2+
class puppetdb::server::puppetdb (
3+
$certificate_whitelist_file = $puppetdb::params::certificate_whitelist_file,
4+
$certificate_whitelist = $puppetdb::params::certificate_whitelist,
5+
$confdir = $puppetdb::params::confdir,
6+
) inherits puppetdb::params {
7+
8+
# Set the defaults
9+
Ini_setting {
10+
path => "${confdir}/puppetdb.ini",
11+
ensure => present,
12+
section => 'puppetdb',
13+
}
14+
15+
$certificate_whitelist_setting_ensure = empty($certificate_whitelist) ? {
16+
true => 'absent',
17+
default => 'present',
18+
}
19+
20+
# accept connections only from puppet master
21+
ini_setting {'puppetdb-connections-from-master-only':
22+
ensure => $certificate_whitelist_setting_ensure,
23+
path => "${confdir}/puppetdb.ini",
24+
section => 'puppetdb',
25+
setting => 'certificate-whitelist',
26+
value => $certificate_whitelist_file,
27+
}
28+
29+
file { $certificate_whitelist_file:
30+
ensure => $certificate_whitelist_setting_ensure,
31+
content => template('puppetdb/certificate-whitelist.erb'),
32+
mode => '0644',
33+
owner => 0,
34+
group => 0,
35+
}
36+
}

‎spec/unit/classes/server/puppetdb_ini_spec.rb‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
require 'spec_helper'
2+
3+
describe 'puppetdb::server::puppetdb', :type => :class do
4+
context 'on a supported platform' do
5+
let(:facts) do
6+
{
7+
:osfamily => 'RedHat',
8+
:fqdn => 'test.domain.local',
9+
}
10+
end
11+
12+
it { should contain_class('puppetdb::server::puppetdb') }
13+
14+
describe 'when using default values' do
15+
it { should contain_ini_setting('puppetdb-connections-from-master-only').
16+
with(
17+
'ensure' => 'absent',
18+
'path' => '/etc/puppetlabs/puppetdb/conf.d/puppetdb.ini',
19+
'section' => 'puppetdb',
20+
'setting' => 'certificate-whitelist',
21+
'value' => '/etc/puppetlabs/puppetdb/certificate-whitelist'
22+
)}
23+
it { should contain_file('/etc/puppetlabs/puppetdb/certificate-whitelist').
24+
with(
25+
'ensure' => 'absent',
26+
'owner' => 0,
27+
'group' => 0,
28+
'mode' => '0644',
29+
'content' => ''
30+
)}
31+
end
32+
33+
describe 'when restricting access to puppetdb' do
34+
let(:params) do
35+
{
36+
'certificate_whitelist' => [ 'puppetmaster' ]
37+
}
38+
end
39+
it { should contain_ini_setting('puppetdb-connections-from-master-only').
40+
with(
41+
'ensure' => 'present',
42+
'path' => '/etc/puppetlabs/puppetdb/conf.d/puppetdb.ini',
43+
'section' => 'puppetdb',
44+
'setting' => 'certificate-whitelist',
45+
'value' => '/etc/puppetlabs/puppetdb/certificate-whitelist'
46+
)}
47+
it { should contain_file('/etc/puppetlabs/puppetdb/certificate-whitelist').
48+
with(
49+
'ensure' => 'present',
50+
'owner' => 0,
51+
'group' => 0,
52+
'mode' => '0644',
53+
'content' => "puppetmaster\n"
54+
)}
55+
end
56+
end
57+
end

‎templates/certificate-whitelist.erb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<% @certificate_whitelist.each do |cn| -%>
2+
<%= cn %>
3+
<% end -%>

0 commit comments

Comments
 (0)
⚡