Issue #3360 has been updated by Claus Divossen.

What to do with the CSR when "replace_certs" is off/false? I agree with Jeff's 
suggestion to inform the client that it has not been accepted. Ideally you 
would see a warning about it on both sides, client and server. Otherwise you 
would be back to square one with #2890, because the client will get the wrong 
certificates handed out again. 

I wanted to give it a try and I'm looking at the latest code from git. To add a 
warning to the "puppetca --list" output was easy, but to rejected CSRs seems to 
be a bit more complicated. I was very supprised to see that there already is 
code in puppet/network/handler/ca.rb that is especially designed to take care 
of these situations. Is this dead code, a leftover from the migration from 
xml-rpc to rest? Or is it still in use for older client versions? (Is this the 
right place to discuss this, or should this be done on the developer mailing 
list?)

-- Claus
----------------------------------------
Bug #3360: puppetca silently overwrites existing certificates
http://projects.reductivelabs.com/issues/3360

Author: Claus Divossen
Status: Accepted
Priority: High
Assigned to: Markus Roberts
Category: SSL
Target version: 0.25.5
Affected version: 0.25.4
Keywords: puppetca autosigning signed certificate
Branch: 


The puppetca accepts CSRs for CNs/nodenames that already have a signed 
certificate, and signing the new certificates will overwrite the old certs 
without warning or further validation. This seems to be introduced with the 
work on Bug #2890.

The puppetca does not care about already exisiting signed certificates anymore. 
This is especially dangerous in combination with autosigning: When autosigning 
is active, any client can pretend to be another node as long as the desired 
node name matches the autosigning pattern(s). In consequence, autosigning 
completely disables the authorization process for matching node names. 

If there are node specific secrets distributed with puppet, an attacker can 
simply pretend to be another node with the "puppetd --fqdn" option and he will 
get the other node's secrets without any questions asked. 

The default behaviour should be to reject new CSRs for a node that already has 
a signed cert, especially with autosigning. When puppetca is run manually, a 
warning might be sufficient.


-- 
You have received this notification because you have either subscribed to it, 
or are involved in it.
To change your notification preferences, please click here: 
http://reductivelabs.com/redmine/my/account

-- 
You received this message because you are subscribed to the Google Groups 
"Puppet Bugs" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to 
[email protected].
For more options, visit this group at 
http://groups.google.com/group/puppet-bugs?hl=en.

Reply via email to