Re: ACL of cf_serverd

        Hi nick Sorry for my late answer.

  HA, Not as late as this response!

        In fact I would like to know how to make a laptop pc,
        bootstrapped on the server cfengine in local network can
        have access to the directories when it is used elsewhere.
        In local network all is good. So his ip address is dynamic
        and cannot be included in cfengine's ACLs to give him
        access to the server. Is it possible in ACLs to give
        access to the server (allowconnects, or directory ACLs in
        def.json) using their public ppkey. I noticed that if a
        laptop leaves my local network while it is enrolled on my
        server, it no longer has the right to promise updates and
        even less to the securecp of a server file. Thanks again
        for your attention and help.

  There are a few things involved here.

  First, there are multiple layers relating to "ACLs". Hosts must pass
  all of the layers.

  In order to speak with `cf-serverd' a host must be allowed to
  /connect/. This is controlled by [allowconnects] in `body server
  control'. So, if you want a host outside your local network, the
  network that host is coming from must be within an allowed range.
  Next, after connecting in order to continue any conversation the
  connecting host must be trusted (the hub must have a copy of the hosts
  public key and the host must have a copy of the hubs public key). The
  [trustkeysfrom] attribute in body server control allow hosts to
  automatically trust public keys from hosts that connect from trusted
  network addresses. Once the first two layers have been passed [access
  promises] are how files and other resources are shared.

  Access promises are only valid in `server' bundles. Admission can be
  granted based on IP, hostname (reverse lookup), or key digest.

        Is it possible in ACLs to give access to the server
        (allowconnects, or directory ACLs in def.json) using their
        public ppkey

  Yes, you can widen `allowconnects' to allow connections from more
  networks, perhaps from any IPV4 network (`0.0.0.0/0'). Then you could
  add the specific keys you want to allow in to the admit for the
  various access promises you want those keys to have access to.


[allowconnects]
<https://docs.cfengine.com/docs/3.18/reference-components-cf-serverd.html#allowconnects>

[trustkeysfrom]
<https://docs.cfengine.com/docs/3.18/reference-components-cf-serverd.html#trustkeysfrom>

[access promises]
<https://docs.cfengine.com/docs/3.18/reference-promise-types-access.html>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/87k09gxx70.fsf%40northern.tech.