[liukke, asedge] - Fixed openssl.cnf becomes a directory instead of syml... #94
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 2 commits
September 18, 2014 15:58
…ymlink. Change crl.pem to apply mode and group after being created.
|
Thanks for fixing this bug! |
luxflux
added a commit
that referenced
this pull request
Sep 22, 2014
[liukke, asedge] - Fixed openssl.cnf becomes a directory instead of syml...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
...ink. Change crl.pem to apply mode and group after being created.
The most recent version of this module is causing a failure of the exec that generates the crl.pem file on our CentOS 6.5 machines. We traced this back to the openssl.cnf symlink in the easy-rsa directory incorrectly being turned into an empty directory. It appears this is occuring because of the change to the File resource that adds the 'group' and 'recurse' attribute to all file resources.
I did a quick test of the result of setting 'recurse' to true on a file resource that has 'ensure' set to 'link'. It looks like this will result in an empty directory simply because 'recurse' is being set to true and ignores the fact that it should be a link. In order to deal with this, we moved the 'recurse' attribute to only the file resources that are actually intended to be directories.
After fixing the above issue, we ran into another snag on our system where the permissions for the crl.pem file were still incorrect after it was generated. When the client machine tried to connect using openvpn, the server would try to read this crl.pem, get a permission denied error, and fail. The permissions should fix themselves if puppet runs a second time for this module. However, we added a small change to allow the permissions to be consistent with the directories in a single run of puppet.
Let us know if you have any questions. Thanks!