Re: cfengine3 mechanism for signed updates

Hi Valentin,

  Just read your mail. But there is mo link to your implementation 
(source) of your work. So where can I find it?

Regards

On 28/06/2021 17:03, Valentin wrote:
> Hi,
> 
> As laid out in a previous mail [1] I wanted to have a way for 
> cfengine-clients to independently check signatures on the distributed 
> files.
> This way the clients should never use/execute updated files from the hub 
> if they were not independently signed.
> I now have a first working Version of this working (thanks to Nick who 
> answered my many questions on IRC and the mailing list).
> I tested it only on Debian Linux but tried to keep it general purpose 
> and avoid using external dependencies that are unavailable on other 
> platforms.
> External dependencies are hashdeep and gpgv, both easily installable on 
> debian via apt.
> Specifically i am using debian 10.10 and cfengine 3.12.1-2 from the 
> debian repository.
> The files i wrote do not change the MPF but extend and use it.
> Although for cfengine 3.12.1 in debian 1 known bug [2] and another 
> change [3] must be patched. otherwise the augments i set up in def.json 
> don't work.
> 
> I placed update_signed.cf in the additional folder lib/custom and set 
> the masterfiles and staging path according to the debian default to 
> reside in /var/lib/cfengine3.
> 
> The complete workflow is also outlined in the README.md but in short the 
> relevant changes for using it are:
> after changes to the masterfiles:
> - sign the masterfiles and dstribute the hashes and hashes.sig with them 
> for checking
> before bootstrapping a client:
> - distribute the trusted keys database to the client in the location set 
> in def.json
> - this should not be done by cfenginge as you will otherwise distribute 
> your trust via the same mechanism you're trying to secure
> 
> I'd love to hear your opinion on this and I'd be happy to improve this 
> further.
> 
> Cheers,
> Valentin
> 
> [1] https://groups.google.com/g/help-cfengine/c/pcz93QPjr7w/m/PaZQIVHwAQAJ
> [2] https://tracker.mender.io/browse/CFE-2953
> [3] 
> https://github.com/cfengine/masterfiles/commit/26eb50bd827e88041fac2c90b026f781e79d9055 
> 
> 

-- 
Bas van der Vlies
| HPCV Supercomputing | Internal Services  | SURF | 
https://userinfo.surfsara.nl |
| Science Park 140 | 1098 XG Amsterdam | Phone: +31208001300 |
|  [email protected]

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/f9e83451-eec1-baa8-2792-1a1626b5932e%40surf.nl.