Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It seems to me that the recommended way of adding clients to a chef server - or my understanding of it - is flawed.

from the docs:

When the chef-client runs, it checks if it has a client key. If the client key does not exist, it then attempts to "borrow" the validation client's identity to register itself with the server. In order to do that, the validation client's private key needs to be copied to the host and placed in /etc/chef/validation.pem.

So the "validation key" is basically the superuser credential, allowing anyone who possesses it full access to the chef server? Am I reading this right?

Surely the correct model would be for clients to generate their own keypair, and submit the public key to the chef server. Clients should never need access to this superuser "validation key".

How can I do it in this, more secure, manner?

share|improve this question
Puppet uses the model you describe - the client creates a key pair and posts the public key to a server. The key needs to be approved either manually or automatically before the server becomes a puppet node. – Tim Potter Dec 19 '12 at 22:17

It's not quite as insecure as that. The validation key can only be used for a couple of operations required to add a node.

For example if I try to delete a node using the Chef validator key:

$ knife node delete -y foo \
    -u chef-validator \
    -k ~/.chef/chef-validator.pem \
    -s http://chef-server:4000

ERROR: You authenticated successfully to http://chef-server:4000 as chef-validator but you are not authorized for this action
Response:  You are not the correct node (auth_user name: chef-validator, params[:id]: foo), or are not an API administrator (admin: false).

Best practice is to delete the validation.pem file after the node has joined the Chef server.

To actually answer the question, you can create client keys using the knife client create command, but it's up to you to distribute these keys to the clients.

Secure key distribution is a hard problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.