Faidon Liambotis has uploaded a new change for review.
https://gerrit.wikimedia.org/r/239801
Change subject: sslcert: add /etc/ssl/private, set to 0711
......................................................................
sslcert: add /etc/ssl/private, set to 0711
Define File['/etc/ssl/private'] and set its mode to 0711. This
effectively adds o+x to it, so that we can have keypairs with a
different group than ssl-cert, something that is already supported by
::certificate. This allows a more granular approach than the
all-or-nothing of adding certain system users (like Debian-exim) to the
ssl-cert group.
Change-Id: Ief43aeebb22a062f8a47cfdb5af42d493ef33e7c
---
M modules/sslcert/manifests/init.pp
1 file changed, 10 insertions(+), 0 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/01/239801/1
diff --git a/modules/sslcert/manifests/init.pp
b/modules/sslcert/manifests/init.pp
index cc144ad..dc790e3 100644
--- a/modules/sslcert/manifests/init.pp
+++ b/modules/sslcert/manifests/init.pp
@@ -30,6 +30,16 @@
require => Package['ssl-cert'],
}
+ # default permissions are 0710 which is overly restrictive; we support
+ # setting $group to allow other groups to access certain keypairs
+ file { '/etc/ssl/private':
+ ensure => directory,
+ owner => 'root',
+ group => 'ssl-cert',
+ mode => '0711',
+ require => Package['ssl-cert'],
+ }
+
# generic script for fetching the OCSP file for a given cert
file { '/usr/local/sbin/update-ocsp':
mode => '0555',
--
To view, visit https://gerrit.wikimedia.org/r/239801
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ief43aeebb22a062f8a47cfdb5af42d493ef33e7c
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Faidon Liambotis <fai...@wikimedia.org>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
