☰

设置非 CA Puppet Master

tag-icon • tag-icon proxy puppet certificate-authority agent master
设置非 CA Puppet Master

我想设置一个额外的 Puppet Master 来充当非 CA 服务器。

我已经安装并成功使用 Passenger。所涉及的服务器都运行 CentOS 6.6，并且都在同一网络上。Selinux 已设置为宽容。测试环境由以下三台服务器组成：

1.  HOSTNAME=basxtststinfl01, DNS=puppet.xchanginghosting.com,basxtststinfl01.xchanginghosting.com (CA Master)
2.  HOSTNAME=basxtststinfl02, DNS=basxtststinfl02.xchanginghosting.com (non-CA Master)
3.  HOSTANME=basxtststinfl03, DNS=basxtststinfl03.xchanginghosting.com (Agent)

我已经配置了我的第二个 Puppet Master（非 CA），如下所示：

[main]
   dns_alt_names = basxtststinfl02.xchanginghosting.com,basxtststinfl02
   ca_server = basxtststinfl01.xchanginghosting.com

[master]
   ca = false

在添加 dns_alt_names 之后但在 ca 和 ca_servers 之前，我删除了非 CA Puppet Master 上的原始证书并重新生成了另一个证书。

+ "basxtststinfl01.xchanginghosting.com" (SHA256) E6:5D:56:39:16:22:A0:FD:8A:C1:AF:83:EB:80:94:2D:74:CE:1F:75:D5:3A:F7:92:EF:36:1A:85:4C:EA:58:F2 (alt names: "DNS:basxtststinfl01", "DNS:basxtststinfl01.xchanginghosting.com", "DNS:puppet", "DNS:puppet.xchanginghosting.com")

到目前为止这是正确的方法吗？

我的虚拟主机文件如下所示：

LoadModule passenger_module /usr/lib/ruby/gems/1.8/gems/passenger-4.0.59/buildout/apache2/mod_passenger.so
PassengerRoot /usr/lib/ruby/gems/1.8/gems/passenger-4.0.59
PassengerDefaultRuby /usr/bin/ruby
PassengerMaxRequests 1000
PassengerMaxPoolSize 12
PassengerPoolIdleTime 1500
PassengerStatThrottleRate 120

Listen 8140

<VirtualHost *:8140>
    SSLProxyEngine On
    ProxyPassMatch ^/([^/]+/certificate.*)$ https://basxtststinfl01.xchanginghosting.com:8140/$1

    SSLEngine on
    SSLProtocol             ALL -SSLv2 -SSLv3
    SSLCipherSuite          EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
    SSLHonorCipherOrder     on

    SSLCertificateFile      /var/lib/puppet/ssl/certs/basxtststinfl02.xchanginghosting.com.pem
    SSLCertificateKeyFile   /var/lib/puppet/ssl/private_keys/basxtststinfl02.xchanginghosting.com.pem
    SSLVerifyClient optional
    SSLVerifyDepth  1
    SSLOptions +StdEnvVars +ExportCertData

    RequestHeader unset X-Forwarded-For

    RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
    RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
    RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e

    DocumentRoot /usr/share/puppet/rack/puppetmasterd/public/
    RackBaseURI /
    <Directory /usr/share/puppet/rack/puppetmasterd/>
            Options None
            AllowOverride None
            Order allow,deny
            allow from all
    </Directory>

笔记： 我删除了SSL证书链文件，SSLCA证书文件和SSLCARevocation文件假设我不将它们用于非 CA 目的。

该代理已多次用于其他测试环境，因此在尝试初始代理运行之前，我已删除所有现有证书。然后，我尝试通过非 CA 主服务器 (basxtststinfl02) 请求证书。

# puppet agent --verbose --onetime --no-daemonize --server basxtststinfl02
Info: Creating a new SSL key for basxtststinfl03.xchanginghosting.com
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for basxtststinfl03.xchanginghosting.com
Info: Certificate Request fingerprint (SHA256):  85:13:E4:3E:DE:54:24:44:22:07:7E:E9:51:96:CE:88:89:96:82:35:51:97:91:8C:C0:B9:24:42:50:FD:FE:F3
Info: Caching certificate for ca

到目前为止看起来不错！

然后，我可以在 CA 主服务器 (basxtststinfl01) 上成功签署证书。但是，在我签署证书并在代理上重复 puppet 代理命令后，我看到以下错误：

Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get local issuer certificate for /CN=basxtststinfl02.xchanginghosting.com]
Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet://basxtststinfl02/plugins: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [unable to get local issuer certificate for /CN=basxtststinfl02.xchanginghosting.com]

我完全不知道这个错误在告诉我什么。有其他人成功配置第二个主服务器以充当非 CA 吗？或者上述错误对任何人来说都有意义吗？

答案1

我认为您提供的 CA 证书是错误的。它应该设置为 CA Puppet Master 的 ca.pem。

针对主代理运行第二个主代理，然后将其添加到您的 puppet master vhost 配置中：

SSLCertificateChainFile /var/lib/puppet/ssl/certs/ca.pem
SSLCACertificateFile    /var/lib/puppet/ssl/certs/ca.pem
SSLCARevocationFile     /var/lib/puppet/ssl/crl.pem
SSLCARevocationCheck    chain

为了防止我弄错，我已经检查了我的工作辅助主机的配置，以下是与您的配置的不同之处：

SSLCertificateChainFile /var/lib/puppet/ssl/certs/ca.pem
SSLCACertificateFile    /var/lib/puppet/ssl/certs/ca.pem
SSLCARevocationFile     /var/lib/puppet/ssl/crl.pem
SSLCARevocationCheck    chain

RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e

ProxyPassMatch ^/([^/]+/certificate.*)$ https://ca.puppet.master:8140/$1

<Location ~ "/[^/]+/certificate">
    PassengerHighPerformance Off
</Location>

这至少给你提供了其他可以尝试的东西。

相关内容