what's the purpose of callnum?
by Ken Dreyer
Hi folks,
I was reading in the source about callnum and wondering: what is the
purpose of callnum?
Is it a security feature, or just a way to maintain write operation order?
It looks like Koji writes a new callnum integer to the database for
every authenticated RPC, even if that RPC is only doing a read-only
operation like getBuild.
- Ken
4 years, 7 months
"koji-ssl-admin" utility
by Ken Dreyer
Hi folks,
I've written a simple "koji-ssl-admin" utility:
https://pagure.io/koji-tools/pull-request/19
The current Koji Server Howto guide includes a lot of steps to run openssl by
hand, and I find I make mistakes easily in this area.
This tool makes it trivial to generate the required SSL keys, CSRs, and CA to
set up a Koji environment. It has opinionated settings, like fixed, safe key
sizes so you can get up and running out of the box quickly.
You can use this to create your own Koji-specific CA and sign HTTPS certs and
user certs, or you can just generate the CSRs to submit to an official CA
later.
This generates the certs with single commands and predictable filenames, so
it's easy to wrap this with scripts or config management systems like Ansible.
Here are the sub-commands:
$ koji-ssl-admin --help
usage: koji-ssl-admin [-h] {server-csr,user-csr,new-ca,sign} ...
Common Koji SSL admin operations:
1) Generate a server key and CSR for HTTPS on kojihub or kojiweb.
You will pass this CSR (cert signing request) to a master CA for signing.
You will need these even if you use Kerberos authentication.
You will also need these regardless if you use an external CA or a testing
one that you generate with this tool.
2) Generate a user account key and CSR.
You will pass this CSR (cert signing request) to a master CA for signing.
You only need these if you use SSL cert authentication (not Kerberos).
These might be usable with an external CA if you have one.
3) Generate a new master CA.
You only need this if you don't have an external CA in your environment
that can sign CSRs. (For example, in a testing environment.) Generates new
"koji-ca.key" and "koji-ca.crt" files. The CA is valid for ten years from
today.
4) Sign a CSR for a user or server with a master CA.
Like "master CA" above, you only need this if you don't have an external CA
in your environment. (For example, in a testing environment.)
You can use this to sign server certs or user certs with your CA.
Never share the .key files or post them in a public location.
positional arguments:
{server-csr,user-csr,new-ca,sign}
server-csr Generate a new server key and CSR for an HTTPS
server(eg. kojihub or kojiweb).
user-csr Generate a new key and CSR for a koji user account.
new-ca Generate a new self-signed SSL CA to sign CSRs.
sign Sign a CSR with our Koji CA.
optional arguments:
-h, --help show this help message and exit
4 years, 8 months