Ticket #748: puppet-0.23.1_Tightened_Config.patch

lib/puppet/configuration.rb

@@ -51 +51 @@
-            syslog.  Syslog has a fixed list of valid facilities, and you must
-            choose one of those; you cannot just make one up."],
-        :statedir => { :default => "$vardir/state",
-
+
+
+
-            :desc => "The directory where Puppet state is stored.  Generally,
-                this directory can be removed without causing harm (although it
-                might result in spurious service restarts)."
-        },
-        :statefile => { :default => "$statedir/state.yaml",
-
+
+
+
-            :desc => "Where puppetd and puppetmasterd store state associated
-                with the running configuration.  In the case of puppetmasterd,
-                this file reflects the state discovered through interacting
@@ -65 +69 @@
-            },
-        :ssldir => {
-            :default => "$confdir/ssl",
-771
+1750
-            :owner => "root",
+            :group => "puppet",
-            :desc => "Where SSL certificates are kept."
-        },
-        :rundir => { :default => rundir,
-
+
+
+
-            :desc => "Where Puppet PID files are kept."
-        },
-        :genconfig => [false,
@@ -139 +146 @@
-        :certdir => ["$ssldir/certs", "The certificate directory."],
-        :publickeydir => ["$ssldir/public_keys", "The public key directory."],
-        :privatekeydir => { :default => "$ssldir/private_keys",
+            :owner => "$user",
+            :group => "$group",
-            :mode => 0750,
-            :desc => "The private key directory."
-        },
-        :privatedir => { :default => "$ssldir/private",
+            :owner => "root",
+            :group => "$group",
-            :mode => 0750,
-            :desc => "Where the client stores private certificate information."
-        },
-        :passfile => { :default => "$privatedir/password",
+            :owner => "root",
+            :group => "root",
-            :mode => 0640,
-            :desc => "Where puppetd stores the password for its private key.
-                Generally unused."
-        },
-        :hostcsr => { :default => "$ssldir/csr_$certname.pem",
-
+
+
+
-            :desc => "Where individual hosts store and look for their certificates."
-        },
-        :hostcert => { :default => "$certdir/$certname.pem",
-
+
+
+
-            :desc => "Where individual hosts store and look for their certificates."
-        },
-        :hostprivkey => { :default => "$privatekeydir/$certname.pem",
+            :owner => "root",
+            :group => "root",
-            :mode => 0600,
-            :desc => "Where individual hosts store and look for their private key."
-        },
-        :hostpubkey => { :default => "$publickeydir/$certname.pem",
-
+
+
+
-            :desc => "Where individual hosts store and look for their public key."
-        },
-        :localcacert => { :default => "$certdir/ca.pem",
-
+
+
+
-            :desc => "Where each client stores the CA certificate."
-        }
-    )
@@ -177 +200 @@
-        :cadir => {  :default => "$ssldir/ca",
-            :owner => "$user",
-            :group => "$group",
-7
+5
-            :desc => "The root directory for the certificate authority."
-        },
-        :cacert => { :default => "$cadir/ca_crt.pem",
-            :owner => "$user",
-            :group => "$group",
-6
+4
-            :desc => "The CA certificate."
-        },
-        :cakey => { :default => "$cadir/ca_key.pem",
-            :owner => "$user",
-            :group => "$group",
-6
+4
-            :desc => "The CA private key."
-        },
-        :capub => { :default => "$cadir/ca_pub.pem",
-            :owner => "$user",
-            :group => "$group",
+            :mode => 0640,
-            :desc => "The CA public key."
-        },
-        :cacrl => { :default => "$cadir/ca_crl.pem",
-            :owner => "$user",
-            :group => "$group",
-64
+40
-            :desc => "The certificate revocation list (CRL) for the CA. Set this to 'none' if you do not want to use a CRL."
-        },
-        :caprivatedir => { :default => "$cadir/private",
-            :owner => "$user",
-            :group => "$group",
-7
+5
-            :desc => "Where the CA stores private certificate information."
-        },
-        :csrdir => { :default => "$cadir/requests",
-            :owner => "$user",
-            :group => "$group",
+            :mode => 0750,
-            :desc => "Where the CA stores certificate requests"
-        },
-        :signeddir => { :default => "$cadir/signed",
-            :owner => "$user",
-            :group => "$group",
-7
+5
-            :desc => "Where the CA stores signed certificates."
-        },
-        :capass => { :default => "$caprivatedir/ca.pass",
-            :owner => "$user",
-            :group => "$group",
-6
+0
-            :desc => "Where the CA stores the password for the private key"
-        },
-        :serial => { :default => "$cadir/serial",
-            :owner => "$user",
-            :group => "$group",
+            :mode => 0640,
-            :desc => "Where the serial number for certificates is stored."
-        },
-        :autosign => { :default => "$confdir/autosign.conf",
-
+
+
+
-            :desc => "Whether to enable autosign.  Valid values are true (which
-                autosigns any key request, and is a very bad idea), false (which
-                never autosigns any key request), and the path to a file, which
@@ -250 +278 @@
-        :keylength => [1024, "The bit length of keys."],
-        :cert_inventory => {
-            :default => "$cadir/inventory.txt",
-4
+0
-            :owner => "$user",
-            :group => "$group",
-            :desc => "A Complete listing of all certificates"
@@ -280 +308 @@
-        :masterlog => { :default => "$logdir/puppetmaster.log",
-            :owner => "$user",
-            :group => "$group",
-6
+4
-            :desc => "Where puppetmasterd logs.  This is generally not used,
-                since syslog is the default log destination."
-        },
-        :masterhttplog => { :default => "$logdir/masterhttp.log",
-            :owner => "$user",
-            :group => "$group",
-6
+4
-            :create => true,
-            :desc => "Where the puppetmasterd web server logs."
-        },
@@ -319 +347 @@
-    self.setdefaults(:puppetd,
-        :localconfig => { :default => "$statedir/localconfig",
-            :owner => "root",
-
+
+
-            :desc => "Where puppetd caches the local configuration.  An
-                extension indicating the cache format is added automatically."},
-        :classfile => { :default => "$statedir/classes.txt",
-            :owner => "root",
-
+
+
-            :desc => "The file in which puppetd stores a list of the classes
-                associated with the retrieved configuratiion.  Can be loaded in
-                the separate ``puppet`` executable using the ``--loadclasses``
-                option."},
-        :puppetdlog => { :default => "$logdir/puppetd.log",
-            :owner => "root",
+            :group => "root",
-            :mode => 0640,
-            :desc => "The log file for puppetd.  This is generally not used."
-        },
-        :httplog => { :default => "$logdir/http.log",
-            :owner => "root",
+            :group => "root",
-            :mode => 0640,
-            :desc => "Where the puppetd web server logs."
-        },
@@ -366 +398 @@
-        
-    self.setdefaults(:filebucket,
-        :clientbucketdir => {
+            :owner => "$user",
+            :group => "$group",
-            :default => "$vardir/clientbucket",
-            :mode => 0750,
-            :desc => "Where FileBucket files are stored locally."