1

Is there a way I can set a puppet master to auto accept all certs from clients (so I don't have to puppetca on the master each time)?

1
  • If you have a consistent naming scheme you could presign a generate and sign a bunch of keys on the master, and then pull them to the client when you install the client the first time. This might be a bit safer over the autosign. See serverfault.com/questions/137292/…
    – Zoredache
    Nov 2, 2012 at 18:13

3 Answers 3

5

Create a file /etc/puppet/autosign.conf on the master, containing the domain names of the hosts for which you want certificates signed automatically.

Example:

www.example.com
*.example.org
*
3
echo "*" > /etc/puppet/autosign.conf

Or you can be a little more secure (but not really, since a client sets its own cert name; someone wanting illegitimate access to your puppet master would just need to know what name to fake) by limiting it to a specific domain:

echo "*.stackexchange.com" > /etc/puppet/autosign.conf
3
  • This is on the master? Nov 2, 2012 at 17:31
  • @KyleBrandt Yup, on the CA master. That file is the default location (or more specifically, $confdir/autosign.conf is the default), but can be changed with the autosign setting in puppet.conf. Nov 2, 2012 at 17:33
  • 1
    @KyleBrandt: Would you like to know more? docs.puppetlabs.com/guides/configuring.html
    – Scott Pack
    Nov 2, 2012 at 17:40
2

I'm personally not a fan of automatically signing these certificates for the reasons already outlined.

I put together a small script kicked off during my kickstarts which runs the following:

echo Configuring local Puppet instance...
/usr/sbin/puppetd --waitforcert 900
sleep 10
echo We will use $HOSTNAME for all future requests...
echo Running server side script..
chvt 1
ssh -q -t $USERNAME@puppetmaster auto_client.sh $HOSTNAME
chvt 6

auto_client.sh

#! /bin/bash
NEWHOST=$1

sudo puppetca --sign $NEWHOST

if ! ( cat /etc/puppet/manifests/* | grep "$NEWHOST" )
then
    NHFILE=/etc/puppet/manifests/temp.pp
    echo node \'$NEWHOST\' >>  $NHFILE
    echo  { >> $NHFILE
    echo    include linux_base >>  $NHFILE
    echo  } >> newhost.cfg >>  $NHFILE
fi

I seriously thought about doing something like using a SSL certificate stored on a USB stick for the SSH connection but this proved more convenient.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.