Re: ACL cf_served

thierry thunot <[email protected]> writes: > will this also work for a
client to a server? It's not basically between two servers? We can then
on the server authorize the clients with > their ppkey to download the
promises?

Hi Thierry,

`access' type promises already (since 3.6.0) have the capability to
/grant/ and /deny/ access to a path based on key using the
[`admit_keys'] and [`deny_keys'] attributes. The new feature that
Vratislav mentioned ([CFE-3448]) brings the capability for a client to
further restrict itself to only allow `copy_from' when the `servers'
attribute is used (aka a remote copy) to copy from hosts with specific
keys via the [`copyfrom_restrict_keys' attribute in `body agent
control'].

So, from the perspective of cf-served who is sharing files with remote
agents, you can use `admit_keys' and `deny_keys' to allow/prevent
individual hosts from accessing files based on the clients host key
digest.

From the perspective of an agent copying remote files, you can use the
`copyfrom_restrict_keys' attribute to make sure that you are only
copying files from an enumerated set of hosts based on their hostkey
digest.

I think that you were looking for `admit_keys' and `deny_keys', is that
correct?

Does that make sense?


[`admit_keys']
<https://docs.cfengine.com/docs/master/reference-promise-types-access.html#admit_keys>

[`deny_keys']
<https://docs.cfengine.com/docs/master/reference-promise-types-access.html#deny_keys>

[CFE-3448] <https://tracker.mender.io/browse/CFE-3448>

[`copyfrom_restrict_keys' attribute in `body agent control']
<https://docs.cfengine.com/docs/master/reference-components-cf-agent.html#copyfrom_restrict_keys>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/87h76329jj.fsf%40northern.tech.

-- 
Nick Anderson | Doer of Things | (+1) 785-550-1767 | https://northern.tech

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/87h76329jj.fsf%40northern.tech.