We distribute secrets via configuration management (in our case, via
Cfengine).
During the first reboot after FAI the Cfengine client registers itself
to the Cfengine server and pulls its credentials from a dedicated part
of the repository. In Cfengine, it is possible to restrict the allowed
ip addresses for self registration as well as for repository access.
Each host is assigned a dedicated host-specific "secure repository"
where all credentials are stored, to which other clients do not have access.
So when a host is about to be installed, the hosts ip address is
manually enabled and immediately disabled after self registration is
complete.
This system is far from bullet proof, with the highest risk being a race
condition during the self-registration phase of the client. All further
repository access is authenticated and encrypted.
With a clever combination of timing and faking the ip address of the
legitimate client, one could take advantage of this race condition. But
even then, this would attract attention, because the legitimate client
couldn't self-register anymore.
Another downside is that this system doesn't scale well. Credentials
have to be placed manually for all hosts and hosts have to be enabled
manually as well. We could write some kind of management interface to
further automate this, but with about 70 hosts that are not reinstalled
on a daily basis, there is simply no necessity for this.
Cheers,
Robert
Am 07.07.22 um 08:12 schrieb Diego Zuccato:
Hi all.
Is there a preferred way to pass a (different) secret to every host
being installed?
Something to implement a workflow like:
- admin asks Salt to (re)install a host
- salt handles shutdown and switch reconfiguration (OT)
- salt tells FAIserver to enable install of given host
- FAI generates the secret and passes it back to Salt (or Salt
generates the secret and passes it to FAI, as long there's a shared
secret)
- the host boots via network and installs as usual, saving/using the
given secret
- FAI (or the reinstalled host) tells Salt reinstall is complete and
Salt "cleans up" (reconfig switches & so on) (OT)
The only "solution" I could find is to save the secret in
/srv/tftp/fai/pxelinux.cfg/C0A8xxyy in append line, like FAI_FLAGS,
FAI_CONFIG_SRC and FAI_ACTION, but since append line can be at most
255 chars there's not much space... I's good just for very small
"secrets" (that gets transferred in the clear, hence the need to
reconfigure the switches).
