Re: ACL cf_served

Hi nick
Sorry for my late answer. 
In fact I would like to know how to make a laptop pc, bootstrapped on the 
server cfengine in local network can have access to the directories when it 
is used elsewhere. In local network all is good. 
So his ip address is dynamic and cannot be included in cfengine's ACLs to 
give him access to the server. Is it possible in ACLs to give access to the 
server (allowconnects, or directory ACLs in def.json) using their public 
ppkey. I noticed that if a laptop leaves my local network while it is 
enrolled on my server, it no longer has the right to promise updates and 
even less to the securecp of a server file. Thanks again for your attention 
and help.



Le jeudi 5 mai 2022 à 19:07:00 UTC+2, Nick Anderson a écrit :

> thierry thunot <[email protected]> writes: 
>>
>> will this also work for a client to a server? It's not basically between 
>> two servers? We can then on the server authorize the clients with their 
>> ppkey to download the promises? 
>>
> Hi Thierry, 
>
> access type promises already (since 3.6.0) have the capability to *grant* 
> and *deny* access to a path based on key using the admit_keys 
> <https://docs.cfengine.com/docs/master/reference-promise-types-access.html#admit_keys> 
> and deny_keys 
> <https://docs.cfengine.com/docs/master/reference-promise-types-access.html#deny_keys> 
> attributes. The new feature that Vratislav mentioned (CFE-3448 
> <https://tracker.mender.io/browse/CFE-3448>) brings the capability for a 
> client to further restrict itself to only allow copy_from when the servers 
> attribute is used (aka a remote copy) to copy from hosts with specific keys 
> via the copyfrom_restrict_keys attribute in body agent control 
> <https://docs.cfengine.com/docs/master/reference-components-cf-agent.html#copyfrom_restrict_keys>. 
>
>
> So, from the perspective of cf-served who is sharing files with remote 
> agents, you can use admit_keys and deny_keys to allow/prevent individual 
> hosts from accessing files based on the clients host key digest. 
>
> From the perspective of an agent copying remote files, you can use the 
> copyfrom_restrict_keys attribute to make sure that you are only copying 
> files from an enumerated set of hosts based on their hostkey digest. 
>
> I think that you were looking for admit_keys and deny_keys, is that 
> correct? 
>
> Does that make sense? 
>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/0a521c68-85a8-4a60-bc9b-c052e8d6820cn%40googlegroups.com.