Jira (PUP-8634) Chown of ssldir Causing Failures

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper commented on PUP-8634   Re: Chown of ssldir Causing Failures For security best-practices, the server process drops privileges to an unprivileged puppet service account. By default the service account is puppet:puppet for OSS and pe-puppet:pe-puppet for PE. The puppet server process (either webrick, passenger or puppetserver) shares the ssl private key and cert with its local puppet agent process, which runs as root. As a result, we set the owner and group for the ssldir to the service account. This behavior should only occur on the puppetserver nodes, not on agent-only nodes. Prior to puppet 4, the puppet package, would create the puppet service accounts. Starting in puppet 4 and up, the accounts are only created by the puppetserver package, since that is the only time they should be needed. However, the accounts may still exist if you installed puppet 3.x and upgraded. For this issue, I'd recommend deleting the puppet service accounts (user and group) from client machines. You can use puppet to do this, but you'll need to make it conditional so it doesn't delete the puppet user/group on the puppetserver host(s). user { 'puppet': ensure => absent } group { 'puppet': ensure => absent } Another option is to set the puppet setting manage_internal_file_permissions=false on agents only, which will prevent puppet from managing the owner, group and mode of its internal files. However, you will need to chown the files back to root:root manually: [root@dlm3vdrk977ay90 ~]# chown -R root:root /etc/puppetlabs/ [root@dlm3vdrk977ay90 ~]# puppet agent -t --no-manage_internal_file_permissions Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Loading facts Info: Caching catalog for dlm3vdrk977ay90.delivery.puppetlabs.net Info: Applying configuration version '1525126771' Notice: Applied catalog in 0.02 seconds [root@dlm3vdrk977ay90 ~]# ls -la /etc/puppetlabs/puppet/ssl total 4 drwxrwx--x 7 root root 110 Apr 30 22:17 . drwxr-xr-x 3 root root 67 Apr 30 22:16 .. drwxr-xr-x 2 root root 56 Apr 30 22:17 certificate_requests drwxr-xr-x 2 root root 69 Apr 30 22:17 certs -rw-r--r-- 1 root root 979 Apr 30 22:17 crl.pem drwxr-x--- 2 root root 6 Apr 30 22:16 private drwxr-x--- 2 root root 56 Apr 30 22:16 private_keys drwxr-xr-x 2 root root 56 Apr 30 22:16 public_keys Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.