Question: Communication security

[LordMike]

Hi again,

How is the communication between slaves and masters secured? Is it possible for a slave to be contacted by any "master" (or somebody posing as one) and be issued commands?

Other projects for orchestration, like Salt, use private/public key cryptography, to identify both ends of the communication (master refuses slaves it doesn't know, and slaves refuse masters they don't recognize).

[jhuckaby]

Hello there!

A very valid question. I should have called more attention to this in the documentation, but Cronicle does secure all of its API calls. User requests are obviously authenticated by username/password and then a session cookie, but internal server-to-server communications are also secured. They use a secret key system:

https://github.com/jhuckaby/Cronicle#secret_key

Basically, all the servers in a Cronicle cluster need to have the exact same secret_key in their config.json files. This secret key can be set to anything you want, but it is auto-generated to a random hash on installation. A slave server will only accept incoming requests from a master server that shares the same secret_key.

[LordMike]

Essentially a shared secret.

Is communication secured using TLS?

[jhuckaby]

Shared secret, correct.

Nope, Cronicle doesn't really support HTTPS at this time. That is in the works: #27

[LordMike]

Ideally. One would use HTTPS with client/server authentication. You could replace the shared secret with that (as it's far better).

The process would roughly be:

• Master install creates a "communication certificate" (a client cert), instead of a shared secret
• When installing a slave, copy over the public certificate from the master
  • The slave now knows the master
  • The slave must verify that the client certificate presented in HTTPS is known to it
• The slave will create its own certificate
• The master will contact the slave, and present the user with a confirmation (displaying the public key / the thumbprint of the cert -- which you can also print out after the slave installs itself)
  • The master must now require that the certificate for a given slave matches the certificate on disk

[jhuckaby]

Yup, that would be more secure. I'm worried about ease of setup and the complexity of managing these certs, however. Perhaps it could be implemented as an option.

[LordMike]

If it's entirely enclosed in the Cronicle ecosystem, it should be the same as the current secrets, just longer. You can base-64 encode the needed structures in place of the secret.