2

Currently I am working on a project where we manage our own acceptance and production systems, but the development and testing systems are managed by external parties. We have to assume they have full root access on the systems and thus access to the Chef client private key (client.pem).

This gives third parties access to our Chef server, where we also store our production credentials.

I tried to put the dev/tst systems in a different Chef environment and storing the credentials in the environment, instead of the data bag. However, I found that a Chef client can change it's own environment, so it'd be relatively easy to switch a client to the production environment, thus getting access to those credentials.

By using encrypted data bags and a some selective key distribution we could set up a scheme where all dev boxes have shared secret keys for the dev data bags, test boxes for the test data bags etc. However, this is very cumbersome and error-prone.

Is there a way of preventing an authenticated Chef client from accessing all data on a Chef server?

2 Answers 2

2

Separate chef servers is the simplest solution (If you use private chef you can create more than one organisation, which is functionally the same).

Having said that... storing secrets unencrypted in attributes is just a bad idea. Using encrypted databags helps but I reckon the best solution is to use chef-vault:

It cleverly uses the chef client's public key to encrypt data and ensure only authorized nodes have access to secrets (passwords, keys, product codes, etc).

A related question:

Chef chef-validator.pem security

2
  • Agree with chef-vault being a great solution. but still, lot of things can be read by all clients. Nov 15, 2013 at 23:30
  • @StephenKing Sure, and that is what the perimeter defences are for (user passwords and client keys). They prevent anonymous or casual access. To properly protect credentials, you must use encryption. Once you get used to it, chef vault is quite straight forward to use. Nov 16, 2013 at 0:51
0

That's unfortunately only possible with Enterprise Chef - the commercial version.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.