Restrict config write access

[kingpong]

The consul cookbook makes the Consul config writable by the same user that runs the service, which is unnecessary and could be an attack vector. Would you accept a pull request which adds a couple new attributes and uses them for the ownership of /etc/consul?

default['consul']['config_owner'] = 'consul'  # allows overriding with 'root' in wrapper
default['consul']['config_group'] = 'consul'

[johnbellone]

Perhaps we simply remove the attributes passing through in the default recipe (on this resource) and rely on the defaults. If you want to change to root/root you can override the config hash?

[kingpong]

Ah! That didn't even occur to me. I think that's a great solution.

[kingpong]

I may have spoke too soon. The conf.d directory is actually created by consul_service, not consul_config which means it is owned by the service user. Does conf.d need to be writable by the service user? If not, it could be moved into consul_config and belong to node['consul']['config']['owner'].

[johnbellone]

I think it makes sense to move that directory and set permissions accordingly.

[kingpong]

Fixed in #323 and #324.

[nidhishopback]

Hi,

I am facing an issue related to config file permissions. I have overridden the default user of config and service to 'root' in wrapper cookbook :

override['consul']['config']['owner'] = 'root'
override['consul']['config']['group'] = 'root'
override['consul']['service_user'] = 'root'
override['consul']['service_group'] = 'root'

Still, on running chef-client, it looks for consul user to add a service config :(

* file[/etc/consul/conf.d/chef-client.json] action create
      * cannot determine user id for 'consul', does the user exist on this system?
      ================================================================================
      Error executing action `create` on resource 'file[/etc/consul/conf.d/chef-client.json]'
      ================================================================================

      Chef::Exceptions::UserIDNotFound
      --------------------------------
      cannot determine user id for 'consul', does the user exist on this system?

Can you please suggest what I am missing here to have my config files owned by root?

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.