saltstack/salt — pull request #13570 by felskrone (2014-06-19 19:14:59+00:00)
Title: Sign the masters pub-key

This is the improved approach from PR #13143. It enabls true multimaster for minions without having to share keys between the master (except one static signing key pair).

What this does on the master:
1. Create a new keypair on the master that is used just for creating a signature of the masters pubkey. The pub-key of this key-pair needs to be put onto all minions that should be able to verify the signature
2. sign the masters pub-key before it is send to the minion by adding the signature to the msg inwith 'pub_sig' to the msg

What this does on the minion:
3. have the minion check the pubkeys signature in 'pub_sig' if it receives a pubkey that does not match the already existing one. If new signature checks out, update the existing public.

How to use this:

Master1 config:
master_sign_key_name: 'master_sign'
master_sign_pubkey: True

Minion config:
master_sign_key_name: 'master_sign'
verify_master_pub_sig: True

Start the master1.
The master will create the new key-pair in the pki-directory.

Copy the newly generated pubkey (only this one) into the minions pki-directory. This can later be done during a minions bootstrap process. This key does not change at all once its generated by a master.

Start the minion and accept its key on the master.

The minion will verify the signature of the received pubkey.

Setup a second master with the same config as the first one.
Copy the signing key-pair from master one to master2.

Start master2.

Stop the minion, replace master address in config with the address of master2, start the minion.

The pubkey of master2 will check out fine, because its signed with the same key-pair as master1 has and the minion has a working pubkey.

This is not documented yet, because i want your opinion before putting more work into this. If you approve this approach, i will push documentation and more comments of whats happening in the code into this PR.