Re: [Puppet Users] Best practices for infrastructure

Jakov Sosic
Sun, 25 Aug 2013 15:18:22 -0000

On 08/25/2013 02:17 PM, Martin Langhoff wrote:
> On Sat, Aug 24, 2013 at 5:18 PM, Jakov Sosic <jsosic@srce.hr> wrote:
>> Only if you use autosign option. After the certificate is signed,
agents
>> report certname and not hostname.
>
> Well-behaved clients report certname. A malicious client could use one
> cert, but report a different name. AIUI the puppet master checks the
> certificate to allow connection, but uses the client-reported name to
> pick the configuration served.

Hm, are you really sure about that? Can you demonstrate it?

I''m asking out of curiosity cause I''ve thought it
can''t be done.


--
Jakov Sosic