From 3e9677f00a09d0249713ed2fa503e42b07f6d978 Mon Sep 17 00:00:00 2001 From: Brice Figureau Date: Tue, 29 Dec 2009 15:27:54 +0100 Subject: Feature #2839 - fingerprint certificate This patch adds several things: * certificate fingerprinting in --list mode * a puppetca action called "--fingerprint" to display fingerprints of given certificates (or all including CSR) * a --fingerprint puppetd option to display client certificates * each time a CSR is generated, its fingerprint is displayed in the log It is also possible to use --digest in puppetca and puppetd to specify a specific digest algorithm. Signed-off-by: Brice Figureau --- sbin/puppetd | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) (limited to 'sbin/puppetd') diff --git a/sbin/puppetd b/sbin/puppetd index bf7d02838..fd78dc631 100755 --- a/sbin/puppetd +++ b/sbin/puppetd @@ -12,7 +12,8 @@ # [--detailed-exitcodes] [--disable] [--enable] # [-h|--help] [--fqdn ] [-l|--logdest syslog||console] # [-o|--onetime] [--serve ] [-t|--test] [--noop] -# [-V|--version] [-v|--verbose] [-w|--waitforcert ] +# [--digest ] [--fingerprint] [-V|--version] +# [-v|--verbose] [-w|--waitforcert ] # # = Description # @@ -35,7 +36,7 @@ # configuration every 30 minutes. # # Some flags are meant specifically for interactive use -- in particular, -# +test+ and +tags+ are useful. +test+ enables verbose logging, causes +# +test+, +tags+ or +fingerprint+ are useful. +test+ enables verbose logging, causes # the daemon to stay in the foreground, exits if the server's configuration is # invalid (this happens if, for instance, you've left a syntax error on the # server), and exits after running the configuration once (rather than hanging @@ -51,6 +52,15 @@ # which would only apply that small portion of the configuration during your # testing, rather than applying the whole thing. # +# +fingerprint+ is a one-time flag. In this mode +puppetd+ will run once and +# display on the console (and in the log) the current certificate (or certificate +# request) fingerprint. Providing the +--digest+ option allows to use a different +# digest algorithm to generate the fingerprint. The main use is to verify that +# before signing a certificate request on the master, the certificate request the +# master received is the same as the one the client sent (to prevent against +# man-in-the-middle attacks when signing certificates). +# +# # = Options # # Note that any configuration parameter that's valid in the configuration file @@ -72,6 +82,11 @@ # debug:: # Enable full debugging. # +# digest:: +# Change the certificate fingerprinting digest algorithm. The default is MD5. +# Valid values depends on the version of OpenSSL installed, but should always +# at least contain MD5, MD2, SHA1 and SHA256. +# # detailed-exitcodes:: # Provide transaction information via exit codes. If this is enabled, an # exit code of '2' means there were changes, and an exit code of '4' means @@ -119,6 +134,10 @@ # Run the configuration once, rather than as a long-running daemon. This is # useful for interactively running puppetd. # +# fingerprint:: +# Display the current certificate or certificate signing request fingerprint +# and then exit. Use the +--digest+ option to change the digest algorithm used. +# # serve:: # Start another type of server. By default, +puppetd+ will start # a service handler that allows authenticated and authorized remote nodes to -- cgit