Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I restrict other nodes or apply some security check to in my domain.For example I had two systems where one is connected with the puppet server for receiving updates & for second system's I change the hostname to "" & configure the system similar to the first system & runs puppetd -td --waitforcert 60 where it receives the updates from the puppet server.

I want to restrict the same as I mentioned in my example with nodes within the domain & outside the domain.How can this be achieved ?


share|improve this question

Turn off autosigning of certs for new nodes (so that you can verify that the request is legitimate before the client gets access to the master), and make sure the node_name option is set to cert so that Puppet uses only trusted information (the CN in the cert, which you've verified is correct) rather than data which can be spoofed (everything provided by facter).

share|improve this answer
Actually there are 3000+ nodes in my domain & disabling autosign will be a tedious task.Is there any way I can compare "dmidecode -s system-serial-number" & "facter |grep hostname|cut -d ' ' -f 3" through puppet so that if anyone changes hostname from within or outside the domain ? – mac01 Apr 4 '12 at 10:06
also all the node's hostnames are set to system's serial number & I want the same to be persistent in the domain. – mac01 Apr 4 '12 at 10:08
You can do whatever you want. But if you trust anything coming from the client, you're doing it wrong. – womble Apr 4 '12 at 10:59
If you deploy systems so regularly that you can't sign the certificates by hand, consider modifying your bootstrapping system to create the certificate (using cert --generate) and deploy it to the system. – Kyle Smith Apr 4 '12 at 13:47
Also,I am trying to override a hostname.rp from path: /usr/lib/ruby/site_ruby/1.8/facter as, Facter.add(:hostname) do confine :hostname => "serialnumber" setcode do Facter::Util::Resolution.exec('cat /sys/power/states') end end Is the fact code correct as I want puppet to pick serialnumber instead of hostname from facter ? Thanks – mac01 Apr 5 '12 at 8:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.