saltstack/salt — pull request #2416 by ryanschneider (2012-11-01 02:34:22+00:00)
Title: Auto-accept minions with valid x509 certificates

This adds a new feature where minions can be auto-accepted based on a certificate added to the initial auth handshake.

This behavior is controlled by adding a new x509 section to the minion and master configs (documented in the two template files).

This pull request is more to start a dialog than to expect this to be pulled unchanged.

One _major_ caveat is that to fully verify x509 certs I'm using a patched version of M2Crypto from this project:

https://github.com/pulp/pulp/blob/master/deps/m2crypto/m2crypto-0.21.1-x509_crl.patch

As such, the code as written raises a NotImplementedError if x509 is enabled on the master and the patched version of M2Crypto is not detected. Unfortunately it seems like M2Crypto isn't being actively maintained so this may be a deal breaker.

The basic workflow of the code is:

- the master, if configured, loads the certificate authority Cert and CRLs on start-up.
- minion (if configured) sends a *new x509.client_cert* field in the auth packet in *minion_sign_in_payload()*.
- the master (if configured) verifies the minion's cert, based on:
- the minion's cert is valid and not in CRL
- the minion cert's issuer matches an optional regex
- the minion cert's subject matches an optional regex

The subject regex is meant to allow patterns like "^.* CN=(.*)\.example\.com" to restrict auto-allowed minions to a subset in a hopefully more secure way than autosign.conf.

Open questions I'd love feedback on:

- Would this be better written as an external_auth module? At first glance I feel like external_auth is more for running salt as non-root, but perhaps I'm mistaken.
- Currently I'm not handling updates to the CRL over time. I saw some threads about adding extra metadata about the minion public keys, if that pans out I'd love to piggy back on it.

Thanks,
Ryan