User story #6363
Updated by Alexis Mousset about 7 years ago
h2. Node policies h3. CFEngine node policies |*Rudder version*|*Transport*|*Client Identification*|*Client Authentication*|*Server Authentication*| |Rudder version|Transport|Client Identification|Client Authentication|Server Authentication| |3.1|CFEngine "classic" protocol, partly encrypted|node UUID|allowed networks AND (use an IP declared in the inventory OR know the hostname of the node)|TOFU on server key| |4.1, 4.2|TLS 1.0+, "classic" protocol available for 3.1 agents with initial policies|node UUID|allowed networks AND (use an IP declared in the inventory OR know the hostname of the node OR private key matching the public key in the inventory)|TOFU on server key| |4.3|TLS 1.0+|node UUID|allowed networks AND private key matching the public key in the inventory (which if verified or TOFU)|TOFU on server key| Notes: * UUIDs are visible in clear text reports * "rudder agent reset" destroys the link between IPs and known keys (i.e. resets the TOFU at agent level, but not inventory level) h3. Remote run |*Rudder version*|*Transport*|*Client Identification*|*Client Authentication*|*Server Authentication*| |3.1|CFEngine "classic" protocol, partly encrypted|None|allowed networks AND (IP of is the declared policy same from server OR know the hostname of the policy server)|TOFU to node, with a check on server key| |4.1, 4.2|TLS 1.0+, "classic" protocol available for 3.1 agents with initial policies|None|allowed networks AND (IP of the declared policy server OR know the hostname of the policy server)|TOFU on server key| |4.3|TLS 1.0+|None|allowed networks AND server's IP of the declared policy server (which provides and TOFU on the key)|TOFU both sides keys. Exeption : on server key| Notes: * "rudder agent reset" destroys Rudder <4.3 when policy_server.dat contains a hostname, anyone in the link between IPs and known keys (i.e. resets allowed networks knowing the TOFU at agent level, but not inventory level) policy server's hostname can trigger a remote run. h3. Windows DSC node policies |*Rudder version*|*Transport*|*Client Identification*|*Client Authentication*|*Server Authentication*| |Rudder version|Transport|Client Identification|Client Authentication|Server Authentication| |4.2, 4.3|TLS 1.0+|node UUID|allowed networks AND private key matching the public key in the inventory (which if verified or TOFU)|None| h2. Inventories |*Rudder agent*|*Transport*|*Client Identification*|*Client Authentication*|*Server Authentication*| |Rudder agent|Transport|Client Identification|Client Authentication|Server Authentication| |Linux|HTTPS with TLS 1.0+|node UUID|allowed networks AND signature matching the public key in the first inventory (which if verified or TOFU)|None| |Windows DSC|HTTPS with TLS 1.0+|node UUID|allowed networks|None| |AIX|HTTP|node UUID|allowed networks AND signature matching the public key in the first inventory (which if verified or TOFU)|None| h2. Reports |*Transport*|*Client Identification*|*Client Authentication*|*Server Authentication*| |Transport|Client Identification|Client Authentication|Server Authentication| |Clear text TCP/UDP|node UUID|None|None| h2. Sending a file to another node (shared file) TODO