koji-devel December 2018

koji-devel@lists.fedorahosted.org

2 participants
2 discussions

what's the purpose of callnum?
by Ken Dreyer 19 Feb '19

19 Feb '19

Hi folks, I was reading in the source about callnum and wondering: what is the purpose of callnum? Is it a security feature, or just a way to maintain write operation order? It looks like Koji writes a new callnum integer to the database for every authenticated RPC, even if that RPC is only doing a read-only operation like getBuild. - Ken

2 2

"koji-ssl-admin" utility
by Ken Dreyer 07 Jan '19

07 Jan '19

Hi folks, I've written a simple "koji-ssl-admin" utility: https://pagure.io/koji-tools/pull-request/19 The current Koji Server Howto guide includes a lot of steps to run openssl by hand, and I find I make mistakes easily in this area. This tool makes it trivial to generate the required SSL keys, CSRs, and CA to set up a Koji environment. It has opinionated settings, like fixed, safe key sizes so you can get up and running out of the box quickly. You can use this to create your own Koji-specific CA and sign HTTPS certs and user certs, or you can just generate the CSRs to submit to an official CA later. This generates the certs with single commands and predictable filenames, so it's easy to wrap this with scripts or config management systems like Ansible. Here are the sub-commands: $ koji-ssl-admin --help usage: koji-ssl-admin [-h] {server-csr,user-csr,new-ca,sign} ... Common Koji SSL admin operations: 1) Generate a server key and CSR for HTTPS on kojihub or kojiweb. You will pass this CSR (cert signing request) to a master CA for signing. You will need these even if you use Kerberos authentication. You will also need these regardless if you use an external CA or a testing one that you generate with this tool. 2) Generate a user account key and CSR. You will pass this CSR (cert signing request) to a master CA for signing. You only need these if you use SSL cert authentication (not Kerberos). These might be usable with an external CA if you have one. 3) Generate a new master CA. You only need this if you don't have an external CA in your environment that can sign CSRs. (For example, in a testing environment.) Generates new "koji-ca.key" and "koji-ca.crt" files. The CA is valid for ten years from today. 4) Sign a CSR for a user or server with a master CA. Like "master CA" above, you only need this if you don't have an external CA in your environment. (For example, in a testing environment.) You can use this to sign server certs or user certs with your CA. Never share the .key files or post them in a public location. positional arguments: {server-csr,user-csr,new-ca,sign} server-csr Generate a new server key and CSR for an HTTPS server(eg. kojihub or kojiweb). user-csr Generate a new key and CSR for a koji user account. new-ca Generate a new self-signed SSL CA to sign CSRs. sign Sign a CSR with our Koji CA. optional arguments: -h, --help show this help message and exit

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

koji-devel December 2018