Rainer Duffner wrote: > Tom Brown schrieb: > >> Hi >> >> We use cobbler to build a pretty stateless farm that can be rebuilt >> pretty fluidly pretty much all the time as you'd expect. I have however >> never really come up with a great way to preserve ssh keys so that the >> id does not change when the box gets rebuilt. >> >> Does anyone have any ideas on how to achieve this? >> >> > > > The only way would be to pre-calculate them and just copy them in place > as part of the post-install. > OK, maybe somebody can come up with something less brute, but it should > work - if, as you say, your farm doesn't change too often. > > We don't rebuild hosts that often, so I've not seen a need here for me. > > > > cheers, > Rainer > > > _______________________________________________ > cobbler mailing list > [email protected] > https://fedorahosted.org/mailman/listinfo/cobbler >
I had this idea for building a system integrated into cobbler for this. Essentially what would happen is each node in %post would register itself to something like Func (probably Func) and block. At this point the admin has to manually approve the system (autosigning could be dangerous, though you could turn it on) and then func would allow retrieval of the keys. It essentially requires just the registration in %post and would be doable without a Config Management system. The CMS route works too, of course, though this would also work a bit better for laptops and things that might migrate away from the CMS. Of course this is not implemented, so means less than working alternatives. We obviously /can't/ do something silly like embed them in the kickstart since kickstarts are going to be publically accessible no matter what we do. They have to be carried out over some sort of public key infrastructure. I think Func is pretty well suited to the task because we have the "copyfile" function, and we would just need a way to set up a way for Func to push files when it first saw systems register to certmaster. Actually this isn't too bad because certmaster already has a triggers mechanism, thanks to Steve Salesvan. --Michael _______________________________________________ cobbler mailing list [email protected] https://fedorahosted.org/mailman/listinfo/cobbler
