In a follow-on patch, the secret_token.rb file will be removed from the
conductor rpm to remove a security hole. Thanks to matty_dubs for
pointing this out.
---
bin/aeolus-configure | 1 +
recipes/aeolus/manifests/conductor.pp | 7 ++++++-
recipes/aeolus/templates/secret_token.rb | 21 +++++++++++++++++++++
3 files changed, 28 insertions(+), 1 deletions(-)
create mode 100644 recipes/aeolus/templates/secret_token.rb
diff --git a/bin/aeolus-configure b/bin/aeolus-configure
index a1a59a0..9b57b99 100755
--- a/bin/aeolus-configure
+++ b/bin/aeolus-configure
@@ -67,6 +67,7 @@ echo "Launching aeolus configuration recipe..."
export FACTER_AEOLUS_ENABLE_HTTPS=true
export FACTER_AEOLUS_ENABLE_SECURITY=false
+export FACTER_RAILS_TOKEN=`</dev/urandom tr -dc a-f0-9 | head -c128`
NODE_ARRAY=(`echo $PUPPET_NODE | tr "," "\n"`)
for x in "${NODE_ARRAY[@]}"
diff --git a/recipes/aeolus/manifests/conductor.pp
b/recipes/aeolus/manifests/conductor.pp
index aa56331..3eba07f 100644
--- a/recipes/aeolus/manifests/conductor.pp
+++ b/recipes/aeolus/manifests/conductor.pp
@@ -27,6 +27,10 @@ class aeolus::conductor inherits aeolus {
content => template("aeolus/conductor-settings.yml"),
require => Package['aeolus-conductor']}
+ file{"/usr/share/aeolus-conductor/config/initializers/secret_token.rb":
+ content => template("aeolus/secret_token.rb"),
+ require => Package['aeolus-conductor']}
+
file{"/rsyslog": ensure => 'directory' }
file{"/rsyslog/work":
ensure => 'directory',
@@ -65,7 +69,8 @@ class aeolus::conductor inherits aeolus {
Rails::Migrate::Db[migrate_aeolus_database],
Service['httpd'],
Apache::Site[aeolus-conductor], Exec[reload-apache],
- File['/usr/share/aeolus-conductor/config/settings.yml']] }
+ File['/usr/share/aeolus-conductor/config/settings.yml'],
+
File['/usr/share/aeolus-conductor/config/initializers/secret_token.rb']] }
### Initialize and start the aeolus database
# Right now we configure and start postgres, at some point I want
diff --git a/recipes/aeolus/templates/secret_token.rb
b/recipes/aeolus/templates/secret_token.rb
new file mode 100644
index 0000000..30e8161
--- /dev/null
+++ b/recipes/aeolus/templates/secret_token.rb
@@ -0,0 +1,21 @@
+# Copyright 2011 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#
http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Be sure to restart your server when you modify this file.
+
+# Your secret key for verifying the integrity of signed cookies.
+# If you change this key, all old signed cookies will become invalid!
+# Make sure the secret is at least 30 characters and all random,
+# no regular words or you'll be exposed to dictionary attacks.
+Conductor::Application.config.secret_token = '<%= rails_token %>'
--
1.7.6.4