Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-12-06 Thread Adam Bottchen (JIRA)
Title: Message Title


 
 
 
 

 
 
 

 
   
 Adam Bottchen updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Puppet /  PUP-1974  
 
 
  Theme: Sensitive Data in Catalogs   
 

  
 
 
 
 

 
Change By: 
 Adam Bottchen  
 
 
Labels: 
 cstop10 support tse  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)  
 
 

 
   
 

  
 

  
 

   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-04-10 Thread Owen Rodabaugh (JIRA)
Title: Message Title


 
 
 
 

 
 
 

 
   
 Owen Rodabaugh updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Puppet /  PUP-1974  
 
 
  Theme: Sensitive Data in Catalogs   
 

  
 
 
 
 

 
Change By: 
 Owen Rodabaugh  
 
 
Team/s: 
 Data Platform,Platform Core  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)  
 
 

 
   
 

  
 

  
 

   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-03-22 Thread Kenn Hussey (JIRA)
Title: Message Title


 
 
 
 

 
 
 

 
   
 Kenn Hussey updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Puppet /  PUP-1974  
 
 
  Theme: Sensitive Data in Catalogs   
 

  
 
 
 
 

 
Change By: 
 Kenn Hussey  
 
 
Priority: 
 Normal Critical  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)  
 
 

 
   
 

  
 

  
 

   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-02-06 Thread Justin Stoller (JIRA)
Title: Message Title


 
 
 
 

 
 
 

 
   
 Justin Stoller updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Puppet /  PUP-1974  
 
 
  Theme: Sensitive Data in Catalogs   
 

  
 
 
 
 

 
Change By: 
 Justin Stoller  
 
 
Sub-team: 
 Emerald Jade  Language  emerald jade  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.5.1#75006-sha1:7df2574)  
 
 

 
   
 

  
 

  
 

   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-01-25 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
ok - thanks 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v7.0.2#70111-sha1:88534db) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-01-25 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Henrik Lindberg 
 
 
 
 
 
 
 
 
 
 THIS IS A CROSS TEAM EPIC - DO NOT PUT IN A SPRINT. EACH TEAM NEEDS SEPARATE EPIC SUPPORTING THIS.Sensitive information such as passwords or key files contained within Puppet catalogs leaks into locations such as PuppetDB or syslog.  This elevates the necessary security that must be enforced on these external systems.It would be valuable to give manifest/module authors the ability to specify resource properties (such as attributes or titles) which are sensitive.  Components downstream from the catalog compiler could then choose how to handle sensitive data.  For example, the master could redact such fields from the catalog before sending it to PuppetDB.  The agent could be configured to obscure sensitive resource titles from the log when they are acted upon.One possible way to do this would be the addition of a "sensitive" resource type that is compiled into the catalog.  Each instance would specific resource fields to be selected and the preferred means of redaction. These changes need to taken I18N support into consideration. The strings we create should use '% \ {variable}' style formatting to enable i18n string decorations 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v7.0.2#70111-sha1:88534db) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this 

Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-01-24 Thread Eric Delaney (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Eric Delaney commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
@henrik Sure, I linked a ticket PUP-8136, in the logging system for parameter values, we redact the values by using a "%s" in the format string.  
 
 
 
 
 
 
  
 
 
 
 
event.message = param.format(_("change from %s to %s failed: "),
 
 
 
 
 
 
 
This makes it really hard to set this up for translation. We just need to keep translation of strings we are logging in mind so that we don't have to refactor this later. 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v7.0.2#70111-sha1:88534db) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-01-24 Thread Eric Delaney (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Eric Delaney updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Eric Delaney 
 
 
 
 
 
 
 
 
 
 THIS IS A CROSS TEAM EPIC - DO NOT PUT IN A SPRINT. EACH TEAM NEEDS SEPARATE EPIC SUPPORTING THIS.Sensitive information such as passwords or key files contained within Puppet catalogs leaks into locations such as PuppetDB or syslog.  This elevates the necessary security that must be enforced on these external systems.It would be valuable to give manifest/module authors the ability to specify resource properties (such as attributes or titles) which are sensitive.  Components downstream from the catalog compiler could then choose how to handle sensitive data.  For example, the master could redact such fields from the catalog before sending it to PuppetDB.  The agent could be configured to obscure sensitive resource titles from the log when they are acted upon.One possible way to do this would be the addition of a "sensitive" resource type that is compiled into the catalog.  Each instance would specific resource fields to be selected and the preferred means of redaction. These changes need to taken I18N support into consideration . The strings we create should use '%{variable}' style formatting to enable i18n string decorations 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v7.0.2#70111-sha1:88534db) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, 

Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-01-24 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
Eric Delaney You made a note that I18N should be considered when designing this. Can you elaborate on your thoughts? 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v7.0.2#70111-sha1:88534db) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2018-01-23 Thread Eric Delaney (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Eric Delaney updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Eric Delaney 
 
 
 
 
 
 
 
 
 
 THIS IS A CROSS TEAM EPIC - DO NOT PUT IN A SPRINT. EACH TEAM NEEDS SEPARATE EPIC SUPPORTING THIS.Sensitive information such as passwords or key files contained within Puppet catalogs leaks into locations such as PuppetDB or syslog.  This elevates the necessary security that must be enforced on these external systems.It would be valuable to give manifest/module authors the ability to specify resource properties (such as attributes or titles) which are sensitive.  Components downstream from the catalog compiler could then choose how to handle sensitive data.  For example, the master could redact such fields from the catalog before sending it to PuppetDB.  The agent could be configured to obscure sensitive resource titles from the log when they are acted upon.One possible way to do this would be the addition of a "sensitive" resource type that is compiled into the catalog.  Each instance would specific resource fields to be selected and the preferred means of redaction.    These changes need to taken I18N support into consideration 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v7.0.2#70111-sha1:88534db) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at 

Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2017-10-02 Thread Kevin Reeuwijk (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Kevin Reeuwijk commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
Owen Rodabaugh customers fail audits when systems they manage have regulatory requirements on security and the auditor finds a catalog file on the system that contains plaintext secrets. From what KPN told me, they can pass the audits (for now) if the cleartext issues are limited to the Puppet server (i.e. PuppetDB and agent logs), but not if there are unprotected secrets on client machines. 
I've played around with the node_encrypt module, but it's Redact() function only works for arguments that were passed to the module it's called in. You can't simply protect any bit of information (like you can with Sensitive()), you really have to design the flow of information to work with how node_encrypt was designed. This isn't obvious at first, causing confusion for people who try to use the module and vague error messages that lead people to believe the module is broken. Which it isn't, the Redact() function is just designed for a very particular use case that doesn't cover all our needs. 
I agree that ideally the Sensitive data type comes with it's own built-in encryption. However this may take significantly longer to implement as it touches many points in the system. A good stopgap measure that would help customers like KPN today, is to encrypt the agent's catalog file on disk. 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2017-07-31 Thread Kevin Reeuwijk (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Kevin Reeuwijk commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
A relatively easy fix would be to have the agent store the catalog file in encrypted form on disk, using a key that only the agent knows (i.e. built into the agent itself). The agent could then decrypt the catalog file into memory during runs, never extracting the contents in clear text on disk. 
Is this is feasible as an agent-only fix? It wouldn't require any change in the puppet master code and would buy us time to work on the bigger challenge. 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2017-07-24 Thread Geoff Nichols (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Geoff Nichols updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Geoff Nichols 
 
 
 

Team/s:
 
 Agent 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2017-05-31 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Henrik Lindberg 
 
 
 

Component/s:
 
 Type System 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2017-05-31 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Henrik Lindberg 
 
 
 

Sub-team:
 
 Emerald Jade emerald jade  Language 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2017-05-18 Thread Moses Mendoza (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Moses Mendoza updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Moses Mendoza 
 
 
 

Labels:
 
 support  triaged  tse 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2017-05-16 Thread Maggie Dreyer (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Maggie Dreyer updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Maggie Dreyer 
 
 
 

Labels:
 
 support  triaged  tse 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2017-05-05 Thread Lindsey Smith (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Lindsey Smith updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Lindsey Smith 
 
 
 

Team/s:
 
 Puppet Developer Experience Agent 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-12-19 Thread Moses Mendoza (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Moses Mendoza assigned an issue to Unassigned 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Moses Mendoza 
 
 
 

Assignee:
 
 Kylo Ginsberg 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-08-16 Thread Karen Van der Veer (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Karen Van der Veer updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Karen Van der Veer 
 
 
 

Scrum Team/s:
 
 Client Platform,Language, Puppet Server, PuppetDB 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-03-31 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
Eric Sorenson yes, totally agree - that is by far the best option. I discussed that with Adrien Thebo a while ago - we did talked briefly about letting the Encrypted type describe the encryption method and value - thus supporting both actual encrypted value, and late binding handle based encryption simply by choice of encryption-method. Naturally the value in the handle based case is the handle/key (in clear text), but when decrypted it is resolved into the secret value via the remote service indicated by the method. 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-03-31 Thread Eric Sorenson (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Eric Sorenson commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
I read through the linked tickets but didn't see a mention of an alternative approach that seems promising to me - as Adrien Thebo described it elsewhere: 
 
Another option for dealing with sensitive data in the catalogs is to either strip out sensitive information in the catalog and replace it with a reference that the agent cant look up, or never store the sensitive information in the catalog and only ship around catalogs with references to secure information. To complement this we would need a concept of a security or secret provider for the agent. A secret provider could be something like Conjur, or an encrypted sidecar file that ships along with the catalog with the secrets that's encrypted with something like the agent's SSL public key.
 
This kind of late-binding secret lookup is consistent with use-cases where the data is both secret and ephemeral, so embedding it in a (persistent, cached) catalog is doubly wrong. Even if it's not ephemeral, the ability to query and inject secret data at catalog application time would be highly useful. 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-02-23 Thread Charlie Sharpsteen (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Charlie Sharpsteen commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
A good step forward and great POC for retrieving the agent's cert and using it for encryption. However, it would be great to have a solution that works for all resource types and doesn't require the creation of specialized wrappers. 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-02-23 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
That looks neat, but you need to use wrappers around resource types to make that work. 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-02-23 Thread Chris Barker (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Chris Barker commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
Ben Ford just published this node_encrypt forge module that does server side encryption on a per agent basis using the agents ssl public key: 
https://forge.puppetlabs.com/binford2k/node_encrypt 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-02-15 Thread Beth Cornils (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Beth Cornils commented on  PUP-1974 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
  Re: Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 
 
Scott Walker and Verne Lindner this might be interesting to follow. The outcome could directly impact our next steps for the Node Graph security issue. 
cc Steve Quin 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-02-11 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Henrik Lindberg 
 
 
 
 
 
 
 
 
 
 THIS IS A CROSS TEAM EPIC - DO NOT PUT IN A SPRINT. EACH TEAM NEEDS SEPARATE EPIC SUPPORTING THIS. Sensitive information such as passwords or key files contained within Puppet catalogs leaks into locations such as PuppetDB or syslog.  This elevates the necessary security that must be enforced on these external systems.It would be valuable to give manifest/module authors the ability to specify resource properties (such as attributes or titles) which are sensitive.  Components downstream from the catalog compiler could then choose how to handle sensitive data.  For example, the master could redact such fields from the catalog before sending it to PuppetDB.  The agent could be configured to obscure sensitive resource titles from the log when they are acted upon.One possible way to do this would be the addition of a "sensitive" resource type that is compiled into the catalog.  Each instance would specific resource fields to be selected and the preferred means of redaction.  
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit 

Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-02-10 Thread Steve Barlow (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Steve Barlow updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Steve Barlow 
 
 
 

Sprint:
 
 Language Triage 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-02-10 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Henrik Lindberg 
 
 
 

Comment:
 
 meh - you cannot change an Improvement into an Epic (at least not by just changing the type). 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.


Jira (PUP-1974) Theme: Sensitive Data in Catalogs

2016-02-07 Thread Henrik Lindberg (JIRA)
Title: Message Title
 
 
 
 
 
 
 
 
 
 
  
 
 Henrik Lindberg updated an issue 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 Puppet /  PUP-1974 
 
 
 
  Theme: Sensitive Data in Catalogs  
 
 
 
 
 
 
 
 
 

Change By:
 
 Henrik Lindberg 
 
 
 

Summary:
 
 Mechanism for securing sensitive catalog data Theme: Sensitive Data in Catalogs 
 
 
 
 
 
 
 
 
 
 
 
 

 
 Add Comment 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 

 This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) 
 
 
 
 
  
 
 
 
 
 
 
 
 
   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.