Implement automatic puppet Server Authentication

Modify the puppet configuration file to automatically sign the client.
1. edit/etc/puppet. conf.
Add the following content:

[master]autosign=trueautosign = /etc/puppet/autosign.conf

2. edit/etc/puppet/autosign. conf.
Adding * indicates all or adding a domain name. For example:

*.example.com

3. Restart puppetmaster

The above configuration, due to some problems in the storage of the environment, the custom internal domain name is messy and fails to be tested successfully.

Is Reference: http://www.mysqlops.com/2011/09/14/puppet-%E4%B8%AD%E6%96%87%E6%8A%80%E5%B7%A7-puppet-%E5%B8%B8%E8%A7%81%E9%97% AE %E9%A2%98.html, but the original configuration puppet. [puppetmaster] section of conf, but I checked the puppet user manual. I didn't find this section. Only [Master], [main], [Agent], etc.

Puppet is not used for a long time. At first, we do not know that it has an automatic authentication mechanism. We plan to write a third-party monitoring program.

The idea is as follows:

In ubuntu server 12.04, the/var/lib/puppet/SSL/CA/requests/directory is monitored. If a new file is created, run puppetca-s-.

Python implementation:

import osimport timeimport pyinotifyfrom pyinotify import WatchManager, Notifier, ThreadedNotifier, EventsCodes,ProcessEvent"""environment:1.sudo apt-get install python-pyinotify"""wm = WatchManager()mask = pyinotify.IN_CREATE #| pyinotify.IN_DELETE  # watched eventsclass PTmp(ProcessEvent):def process_IN_CREATE(self, event):print "Create: %s" %  os.path.join(event.path, event.name)def process_IN_DELETE(self, event):print "Remove: %s" %  os.path.join(event.path, event.name)notifier = Notifier(wm, PTmp())wdd = wm.add_watch('/var/lib/puppet/ssl/ca/requests', mask, rec=True)while True:  # loop forevertry:notifier.process_events()if notifier.check_events():# read notified events and enqeue themnotifier.read_events()print "monitor success!"rst=popen("puppetca -s -a")file_object = open('log.txt','a')try:file_object.write(time.strftime('%Y-%m-%d %H:%M:%S',time.localtime(time.time())))file_object.write('\n')file_object.writelines(rst)file_object.write('\n')finally:file_object.close( )except KeyboardInterrupt:        # destroy the inotify's instance on this interrupt (stop monitoring)notifier.stop()print "Server for Fail Protection Stopped"break

The above code has tested the listening/etc/test/folder and executed the LS-l command to confirm the success.

The listener for puppet authentication requests is not tested.