Actions
User story #6363
closed
Secure agent/server communication
Pull Request:
UX impact:
Suggestion strength:
User visibility:
Effort required:
Name check:
Fix check:
Regression:
Description
Note: 6.1 and 6.2 represent post-#18286 patch releases.
Node policies¶
CFEngine node policies¶
| Rudder version | Transport | Client Identification | Client Authentication | Server Authentication |
| 4.1 | TLS 1.0+, "classic" protocol available for 3.1 agents with initial policies | node UUID | allowed networks AND (use an IP declared in the inventory OR know the hostname of the node OR private key matching the public key in the inventory) | Broken TOFU on server key |
| 4.3, 5.0 | TLS 1.0+ | node UUID | allowed networks AND private key matching the public key in the inventory (which if verified or TOFU) | Broken TOFU on server key |
| 6.0 | TLS 1.2+ | node UUID | allowed networks AND private key matching the public key in the inventory (which if verified or TOFU) | Broken TOFU on server key |
| 6.1, 6.2 | TLS 1.2+ | node UUID | allowed networks AND private key matching the public key in the inventory (which if verified or TOFU) | TOFU or pre-shared server key |
| 7.0 | TLS 1.2+ | node UUID | allowed networks AND private key matching the public key in the inventory (which if verified or TOFU) | TOFU or pre-shared server key |
Remote run¶
| Rudder version | Transport | Client Identification | Client Authentication | Server Authentication |
| 4.1 | TLS 1.0+, "classic" protocol available for 3.1 agents with initial policies | None | allowed networks AND (IP of the declared policy server OR know the hostname of the policy server) | Broken TOFU on server key |
| 4.3, 5.0 | TLS 1.0+ | None | allowed networks AND IP of the declared policy server (which provides TOFU on the key) | Broken TOFU on server key |
| 6.0 | TLS 1.2+ | None | allowed networks AND IP of the declared policy server (which provides TOFU on the key) | Broken TOFU on server key |
| 6.1, 6.2 | TLS 1.2+ | None | allowed networks AND IP of the declared policy server (which provides TOFU on the key) | TOFU or pre-shared server key |
| 7.0 | TLS 1.2+ | None | allowed networks AND IP of the declared policy server (which provides TOFU on the key) | TOFU or pre-shared server key |
Windows DSC node policies¶
| Rudder version | Transport | Client Identification | Client Authentication | Server Authentication |
| 4.3, 5.0 | TLS 1.0+ | node UUID | allowed networks AND private key matching the public key in the inventory (which if verified or TOFU) | IP |
| 6.0, 6.1, 6.2 | TLS 1.2+ | node UUID | allowed networks AND private key matching the public key in the inventory (which if verified or TOFU) | IP |
| 7.0 | TLS 1.2+ | node UUID | allowed networks AND private key matching the public key in the inventory (which if verified or TOFU) | TOFU or pre-shared server key |
Inventories¶
| Rudder version | Rudder agent | Transport | Client Identification | Client Authentication | Server Authentication |
| 4.1, 4.3, 5.0 | Linux | HTTPS with TLS 1.0+ | node UUID | allowed networks AND signature matching the public key in the first inventory (which if verified or TOFU) | IP |
| 4.1, 4.3, 5.0 | AIX | HTTP | node UUID | allowed networks AND signature matching the public key in the first inventory (which if verified or TOFU) | IP |
| 4.1, 4.3, 5.0 | Windows DSC | HTTPS with TLS 1.0+ | node UUID | allowed networks | IP |
| 6.0, 6.1, 6.2 | Windows DSC | HTTPS with TLS 1.2+ | node UUID | allowed networks | IP |
| 6.0, 6.1, 6.2 | Linux, AIX | HTTPS with TLS 1.2+ | node UUID | allowed networks AND signature matching the public key in the first inventory (which if verified or TOFU) | (optional) existing PKI |
| 7.0 | All | HTTPS with TLS 1.2+ | node UUID | allowed networks AND signature matching the public key in the first inventory (which if verified or TOFU) | TOFU or pre-shared server key |
Reports¶
| Rudder version | Transport | Client Identification | Client Authentication | Server Authentication |
| 4.1, 4.3, 5.0 | Plain text TCP/UDP | node UUID | None | IP |
| 6.0, 6.1, 6.2 | HTTPS with TLS 1.2+ | node UUID | allowed networks AND signature matching the public key in the first inventory (which if verified or TOFU) but syslog fallback | (optional) existing PKI |
| 7.0 | HTTPS with TLS 1.2+ | node UUID | allowed networks AND signature matching the public key in the first inventory (which if verified or TOFU) | TOFU or pre-shared server key |
Sending a file to another node (shared file)¶
TODO
Updated by 
Updated by 
Updated by Jonathan CLARKE 
Updated by 
Updated by 
Updated by
Actions