Hey,
we have implemented similar approach in Katello. Few points:
1) I can confirm the string does not have to be hexa. It works with any
(base64 etc) encoded string.
2) Rake use Bundler and we were facing many issues with incorrect
dependencies (discussed on the ruby sig list). I tend not to use
Bundler-based things in the RPM postun sections, because even when deps
would be incorrect, I would like to have the RPM to be properly
installed. Therefore we generate the same using tr and sed tools.
http://git.fedorahosted.org/git/?p=katello.git;a=commitdiff;h=738bf147939...
It's also much faster.
3) Since the secret_token file is distributed, MD5 RPM validation fails.
I don't think this is an issue and if it worths changing it to a config
file.
$ rpm -qV katello-common
5..T..... /usr/share/katello/config/initializers/secret_token.rb
Good catch!
ps - I am sorry to re-open older thread.
LZ
On Mon, Nov 21, 2011 at 10:55:17AM -0800, Richard Su wrote:
In a follow-on patch, the secret_token.rb file will be removed from
the
conductor rpm to remove a security hole. Thanks to matty_dubs for
pointing this out.
---
bin/aeolus-configure | 1 +
recipes/aeolus/manifests/conductor.pp | 7 ++++++-
recipes/aeolus/templates/secret_token.rb | 21 +++++++++++++++++++++
3 files changed, 28 insertions(+), 1 deletions(-)
create mode 100644 recipes/aeolus/templates/secret_token.rb
diff --git a/bin/aeolus-configure b/bin/aeolus-configure
index a1a59a0..9b57b99 100755
--- a/bin/aeolus-configure
+++ b/bin/aeolus-configure
@@ -67,6 +67,7 @@ echo "Launching aeolus configuration recipe..."
export FACTER_AEOLUS_ENABLE_HTTPS=true
export FACTER_AEOLUS_ENABLE_SECURITY=false
+export FACTER_RAILS_TOKEN=`</dev/urandom tr -dc a-f0-9 | head -c128`
NODE_ARRAY=(`echo $PUPPET_NODE | tr "," "\n"`)
for x in "${NODE_ARRAY[@]}"
diff --git a/recipes/aeolus/manifests/conductor.pp
b/recipes/aeolus/manifests/conductor.pp
index aa56331..3eba07f 100644
--- a/recipes/aeolus/manifests/conductor.pp
+++ b/recipes/aeolus/manifests/conductor.pp
@@ -27,6 +27,10 @@ class aeolus::conductor inherits aeolus {
content => template("aeolus/conductor-settings.yml"),
require => Package['aeolus-conductor']}
+ file{"/usr/share/aeolus-conductor/config/initializers/secret_token.rb":
+ content => template("aeolus/secret_token.rb"),
+ require => Package['aeolus-conductor']}
+
file{"/rsyslog": ensure => 'directory' }
file{"/rsyslog/work":
ensure => 'directory',
@@ -65,7 +69,8 @@ class aeolus::conductor inherits aeolus {
Rails::Migrate::Db[migrate_aeolus_database],
Service['httpd'],
Apache::Site[aeolus-conductor], Exec[reload-apache],
- File['/usr/share/aeolus-conductor/config/settings.yml']] }
+ File['/usr/share/aeolus-conductor/config/settings.yml'],
+
File['/usr/share/aeolus-conductor/config/initializers/secret_token.rb']] }
### Initialize and start the aeolus database
# Right now we configure and start postgres, at some point I want
diff --git a/recipes/aeolus/templates/secret_token.rb
b/recipes/aeolus/templates/secret_token.rb
new file mode 100644
index 0000000..30e8161
--- /dev/null
+++ b/recipes/aeolus/templates/secret_token.rb
@@ -0,0 +1,21 @@
+# Copyright 2011 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#
http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Be sure to restart your server when you modify this file.
+
+# Your secret key for verifying the integrity of signed cookies.
+# If you change this key, all old signed cookies will become invalid!
+# Make sure the secret is at least 30 characters and all random,
+# no regular words or you'll be exposed to dictionary attacks.
+Conductor::Application.config.secret_token = '<%= rails_token %>'
--
1.7.6.4
--
Later,
Lukas Zapletal | E32E400A
RHN Satellite Engineering
Red Hat Czech s.r.o. Brno