Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-1935

puppetd ignores local ca.pem when connecting to master for the first time

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Normal
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: PUP 6.0.0
    • Component/s: None
    • Labels:
    • Template:
    • Team:
      Froyo

      Description

      Hi,

      I have a clean machine, with only puppet.conf configured (using --genconfig) and /etc/puppet/ssl/certs/ca.pem. I now run for the first time puppetd and connect to a server that has a different CA.

      I believe the expected behavior should be that puppetd will abort the connection because it connects to an unauthorized server. Instead, puppetd continues to communicate with the unauthorized master and generates a new certificate request.

      Unless I'm mistaken, this scenario could lead to a security breach: if an attacker gains control over the DNS, it can redirect new machines to its own malicious master. The master will make the node install a rootkit for example. Afterwards the attacker will redirect the DNS back to the original master. The node will then retrieve from the original (unsuspecting) master sensitive information, information that now the attacker can access.

      I'm running puppet version 2.6.2.

      Thanks,
      Tal

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned
              Reporter:
              redmine.exporter redmine.exporter
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Zendesk Support