-
Notifications
You must be signed in to change notification settings - Fork 95
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update procedure Registering a Host to RH Satellite #780
Update procedure Registering a Host to RH Satellite #780
Conversation
@stejskalleos Hi Leos, review time! :) Do you know whether it should be cherry-picked to Foreman 3.0 as well? |
906ff69
to
fc7471c
Compare
fc7471c
to
6b87481
Compare
6b87481
to
bb6bbe5
Compare
To avoid confusion, what we suggest:
That is the recommended option. Alternatively, we can mention this:
|
bb6bbe5
to
ad51876
Compare
# update-ca-trust enable | ||
# update-ca-trust | ||
# curl -sS https://{foreman-example-com}/register ... | ||
---- | ||
+ | ||
If an attacker, located in the network between {Project} and a host, fetches the CA file from the first insecure call, the attacker will be able to access the content of the API calls to and from the registered host and the JSON Web Tokens (JWT). | ||
Therefore, if you have chosen to deploy SSH keys during registration, the attacker will be able to access the host using the SSH key. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I suggest to move "To do this" after this paragraph.
Then break it up into two snippets: one with the update-ca-trust commands (both) and one with the curl command. That should be divided by some filler, something like "To register a host, use the following command".
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
To elaborate this more (I had a meeting sorry), update-ca-trust and curl is one way to do it, the other way is just insecure curl. So we want these two snippets, while I mentioned breaking up the one on line 66-70, that is actually not necessary. Depending on how you like, you might or might not break it I do not insist. It is just we need to have the curl command twice (with and without the insecure option).
I hope it makes sense.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Got it.
However, I think that the "To do this" paragraph would better fit right after "It is recommended", otherwise the flow doesn't make sense IMHO. Check it out in changed files.
ad51876
to
469d5e7
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks, please file against 2.5 if this is 6.10 material, thanks! Merging.
Cherry-pick into: