I'm trying to use puppet to copy a file:

  file{ '/root/.ssh/id_rsa' :
    source =>  'puppet:///modules/certs/.ssh/id_rsa',

The permissions are -r-------- 1 root root.

If I run chmod +r on the file my script works, but with the above permissions puppet fails to copy the file.

Error: /Stage[main]/Main/Node[default]/File[/root/.ssh/id_rsa]: Could not evaluate: Could not retrieve file metadata for puppet:///modules/certs/.ssh/id_rsa: Error 500 on SERVER: Server Error: Permission denied - /etc/puppetlabs/code/environments/production/modules/certs/files/.ssh/id_rsa

I assumed puppet would be running as root and thus would be able to copy the file. Is there a way to do this without changing the permission?


The error message indicates you're using a master/agent setup. In this kind of setup, the Puppet master (or server) usually runs under the puppet user as it's a web application that's simply providing files and catalogs for download.

Only the Puppet agent (on the client) will run as root to make configuration changes to the operating system.

The file on your Puppet master should be readable to the puppet user, either by changing ownership:

chown puppet id_rsa

or giving group read permissions:

chgrp puppet id_rsa
chmod g+r id_rsa

or giving other read permissions, as you did with chmod +r.

Note that there are limited authorisation controls over access to the file. Any host with a valid Puppet SSL key/cert will be able to download the file from the Puppet master, even if they don't have the manifest/file configured. This is not a very secure method to distribute private keys.

  • Thanks I saw something in Puppet 4 cookbook about properly sharing sensitive data. I will have to find it and re-read. But this will work for my initial proof of concept. May 2 '17 at 12:53
  • For future readers hiera-gpg looks like a possible solution for this (Puppet Cookbook, third edition, p. 78). May 2 '17 at 14:18
  • 1
    hiera-eyaml has now replaced hiera-gpg. May 2 '17 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.