Re: [Puppet Users] Best practices for infrastructure

Martin Langhoff
Sun, 25 Aug 2013 12:17:21 -0000

On Sat, Aug 24, 2013 at 5:18 PM, Jakov Sosic <jsosic@srce.hr>
wrote:
> Only if you use autosign option. After the certificate is signed, agents
> report certname and not hostname.

Well-behaved clients report certname. A malicious client could use one
cert, but report a different name. AIUI the puppet master checks the
certificate to allow connection, but uses the client-reported name to
pick the configuration served.

cheers,


m
--
 martin.langhoff@gmail.com
 -  ask interesting questions
 - don''t get distracted with shiny stuff  - working code first
 ~ http://docs.moodle.org/en/User:Martin_Langhoff