Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're using puppet to manage a group of Ubuntu boxes and will shortly require each of these servers to share a common SSL certificate, in order to serve a site over HTTPS. Naturally, we'd like to use puppet to manage the certificate but are conscious of the fact that putting it in a VCS (from where the puppet master gets its modules) mightn't be a great idea—because of the security implications.

Are there any better solutions anyone is aware of?

share|improve this question
add comment

1 Answer

up vote 9 down vote accepted

Disclosure: I am one of the developers of Puppet.

The general practice is to use a special file server mount that offers the content, and then have an ACL on that allowing only the specific systems to get at the files. That allows you to use a source => 'puppet://...' specification without having to have it come from the same place as the other modules.

You might also look to the hiera-gpg module, as documented here, source here. That allows some protection for the content in terms of exposure, so that only approved people, and folks with sufficient access to the Puppet master they could hack the code to get the data, could read it.

share|improve this answer
    
Upvote for being a puppet developer (Thanks!) and suggesting doing it the same way I do for this situation. –  Doug Feb 15 '12 at 14:05
    
No need to vote up just because I am a developer there; I disclose that so people don't get surprised if they go digging. Thanks, though. :) –  Daniel Pittman Feb 15 '12 at 18:26
    
Thank you, that's very helpful! –  markhellewell Feb 20 '12 at 5:47
    
A short update to this: what we eventually ended up doing was to store the SSL certificate in puppet after all—but symmetrically encrypted using GPG. Since the web servers won't be ready for action until they've been deployed to (using Fabric) anyway, we added a step to the deployment process to check for the (encrypted) SSL cert. and decrypt it (prompting for the passphrase). Certificate updates are managed by puppet also. Changes to encrypted cert. contents trigger removal of the decrypted certificate, and the next deploy notices it's missing and decrypts again. –  markhellewell Aug 1 '12 at 3:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.