You could reduce the security issue by using SSH with a private key to a non-root account, preferably one with minimal permissions. Add an entry to your sudoers file, and then use sudo to run the command.
You can further lock down the system with the SSH allowed_keys file; you can set it up that SSH will not get a terminal and can only execute the one command "sudo chef-client".
The chef server does not have the credentials to enforce that. You'd have to
execute something like a "knife ssh" command, with stored root passwords
or root ssh credentials. That's a big security issue.
I'm trying to integrate an 'execute recipe' functionality to my chef server ui.
It has to do the function of 'chef-client' from the UI. Please help me to do so.
Thank you for the suggestions. Is there any way to get the source code of
chef and build from it or contribute to chef. I want to add this
functionality. If some body already have done this please help me with the
implementation part.
You could reduce the security issue by using SSH with a private key to a
non-root account, preferably one with minimal permissions. Add an entry to
your sudoers file, and then use sudo to run the command.
You can further lock down the system with the SSH allowed_keys file; you
can set it up that SSH will not get a terminal and can only execute the one
command "sudo chef-client".
The chef server does not have the credentials to enforce that. You'd
have to
execute something like a "knife ssh" command, with stored root passwords
or root ssh credentials. That's a big security issue.
I'm trying to integrate an 'execute recipe' functionality to my chef
server ui.
It has to do the function of 'chef-client' from the UI. Please help me
to do so.
While I'm sure you mean well, I think you underestimate what you are suggesting. I don't want to turn you off from contributing to Chef, but I think this is probably not something you would want to tackle right out of the starting gate. If you are looking for good remote-execution systems that are well integrated with Chef, you can get a trial version of Enterprise Chef I think.
Thank you for the suggestions. Is there any way to get the source code of chef and build from it or contribute to chef. I want to add this functionality. If some body already have done this please help me with the implementation part.
Thank you,
On Mon, Mar 17, 2014 at 8:56 AM, Kevin Keane Subscription subscription@kkeane.com wrote:
You could reduce the security issue by using SSH with a private key to a non-root account, preferably one with minimal permissions. Add an entry to your sudoers file, and then use sudo to run the command.
You can further lock down the system with the SSH allowed_keys file; you can set it up that SSH will not get a terminal and can only execute the one command "sudo chef-client".
The chef server does not have the credentials to enforce that. You'd have to
execute something like a "knife ssh" command, with stored root passwords
or root ssh credentials. That's a big security issue.
I'm trying to integrate an 'execute recipe' functionality to my chef server ui.
It has to do the function of 'chef-client' from the UI. Please help me to do so.
While I'm sure you mean well, I think you underestimate what you are
suggesting. I don't want to turn you off from contributing to Chef, but I
think this is probably not something you would want to tackle right out of
the starting gate. If you are looking for good remote-execution systems
that are well integrated with Chef, you can get a trial version of
Enterprise Chef I think.
Thank you for the suggestions. Is there any way to get the source code
of chef and build from it or contribute to chef. I want to add this
functionality. If some body already have done this please help me with the
implementation part.
Thank you,
On Mon, Mar 17, 2014 at 8:56 AM, Kevin Keane Subscription < subscription@kkeane.com> wrote:
You could reduce the security issue by using SSH with a private key to a
non-root account, preferably one with minimal permissions. Add an entry to
your sudoers file, and then use sudo to run the command.
You can further lock down the system with the SSH allowed_keys file; you
can set it up that SSH will not get a terminal and can only execute the one
command "sudo chef-client".
The chef server does not have the credentials to enforce that. You'd
have to
execute something like a "knife ssh" command, with stored root
passwords
or root ssh credentials. That's a big security issue.
I'm trying to integrate an 'execute recipe' functionality to my chef
server ui.
It has to do the function of 'chef-client' from the UI. Please help me
to do so.