-
Notifications
You must be signed in to change notification settings - Fork 261
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ansible: make ovirt-vmconsole host certificate readable #561
Conversation
...unner-service-project/project/roles/ovirt-host-deploy-vm-console-certificates/tasks/main.yml
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This only worked till now since the certificates were mistakenly opened to others
I don't understand this sentence -- making the public certificate readable to everybody is what this patch does... Do you mean "all certificates"? Please make the text in the commit message clear, this is delicate stuff and is important to avoid any confusion.
...unner-service-project/project/roles/ovirt-host-deploy-vm-console-certificates/tasks/main.yml
Outdated
Show resolved
Hide resolved
ovirt-vmconsole is running under its own user and need access to certificates. With umask 077 on engine these files are not readable by group or others, and they are owned by root, so let's be explicit about the desired target file mode.
ec71685
to
1cf55c8
Compare
[root@ost-basic-suite-master-host-0 ~]# ls -l /etc/pki/ovirt-vmconsole/ |
/ost |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1
verified vmconsole on disa stig-enabled setup manually |
ost failed on a flaky test, i was able to resume and finish that run manually |
ovirt-vmconsole is running under its own user and need access to
certificates. This only worked till now since the certificates were
mistakenly opened to others, but now it prevents sshd to acess its host
key