Mcollective + Choria client + Puppet Run Failure

Conzar · June 11, 2018, 4:26am

Problem:
The root user is not allowed to run the mco command due to a limitation with the choria client (security). So I set the mcollective user to foreman_proxy and made appropriate changes to sudoers file.

The foreman-proxy tries to use sudo when executing mco. I manually executed the same command as the foreman-proxy and get the following output:

user foreman-proxy is not allowed to execute '/opt/puppetlabs/bin/mco puppet runonce -I <REDACTED>

The foreman-proxy user can execute the mco command without sudo without trouble.

Expected outcome:
Puppet Run should be able to use mco without issues sudo so that mco can kick puppet agents.

Foreman and Proxy versions:
1.17.1

Foreman and Proxy plugin versions:

1.17.1

ekohl · June 11, 2018, 9:00am

That sounds a lot like the sudo issue we saw on Ubuntu. Could you try this patch and report if it works? If it does, we should cherry pick it into 1.17.2:

https://github.com/theforeman/smart-proxy/commit/6e81b2ed589061348076ea021411ed65d69d47ce

Conzar · June 11, 2018, 10:06pm

I wrote a small script to test out the patch.

#!/bin/bash
/usr/bin/sudo -u foreman-proxy /opt/puppetlabs/bin/mco ping
/usr/bin/sudo -Hu foreman-proxy /opt/puppetlabs/bin/mco ping
/opt/puppetlabs/bin/mco ping

I ran the following command:
sudo su -s /bin/bash foreman-proxy

Then ran the script.
For both sudo commands, I get the following error

Sorry, user foreman-proxy is not allowed to execute '/opt/puppetlabs/bin/mco ping

But for the non-sudo case, the command succeeds.

Matt_Cahill · June 12, 2018, 2:25am

Sounds like the sudo config you have still isn’t quite right.

Until that patch is released you can work around it by adding a file to /etc/sudoers.d that looks like this. I don’t think you can set mcollective_user to foreman-proxy though as that user normally has it’s shell set to /bin/false. We use another system account specifically for the purpose so the choria certs can be secured properly and not kept in /usr/share/foreman-proxy.

change mcollective_user to the service account of your choice

Defaults:foreman-proxy !requiretty
Defaults:foreman-proxy env_keep -= \"HOME\"
foreman-proxy ALL = (mcollective_user) NOPASSWD : /opt/puppetlabs/bin/mco puppet runonce *

after the patch the following line will not be required

Defaults:foreman-proxy env_keep -= \"HOME\"

cheers

Matt

Conzar · June 12, 2018, 4:03am

The patch plus the changes to the foreman-proxy sudoers file worked!

The problem is that the foreman-proxy suoders file is controlled by the foreman-proxy puppet module. So I have to keep puppet turned off otherwise, puppet will revert my changes.

github.com

theforeman/puppet-foreman_proxy/blob/master/manifests/config.pp#L120


  feature   => 'Logs',
  listen_on => $::foreman_proxy::logs_listen_on,
}


if $foreman_proxy::puppetca or $foreman_proxy::puppet {
  if $foreman_proxy::use_sudoersd {
    if $foreman_proxy::manage_sudoersd {
      ensure_resource('file', "${::foreman_proxy::sudoers}.d", {'ensure' => 'directory'})
    }


    file { "${::foreman_proxy::sudoers}.d/foreman-proxy":
      ensure  => file,
      owner   => 'root',
      group   => 0,
      mode    => '0440',
      content => template('foreman_proxy/sudo.erb'),
    }
  } elsif $foreman_proxy::use_sudoers {
    augeas { 'sudo-foreman-proxy':
      context => "/files${::foreman_proxy::sudoers}",
      changes => template('foreman_proxy/sudo_augeas.erb'),

github.com

theforeman/puppet-foreman_proxy/blob/master/templates/sudo_augeas.erb

<%-
  user = scope.lookupvar('foreman_proxy::user')
  index = 0
-%>
<% if scope.lookupvar('foreman_proxy::puppetca')
  index += 1
-%>
set spec[user = '<%= user %>'][<%=index%>]/user <%= user %>
set spec[user = '<%= user %>'][<%=index%>]/host_group/host ALL
set spec[user = '<%= user %>'][<%=index%>]/host_group/command '<%= scope.lookupvar('foreman_proxy::puppetca_cmd') %> *'
set spec[user = '<%= user %>'][<%=index%>]/host_group/command/runas_user root
set spec[user = '<%= user %>'][<%=index%>]/host_group/command/tag NOPASSWD
rm spec[user = '<%= user %>'][<%=index%>]/host_group/command[position() > 1]<%# delete any other command in the rule %>
<% end -%>
<% if scope.lookupvar("foreman_proxy::puppet") and scope.lookupvar("foreman_proxy::puppetrun_provider") == 'puppetrun'
  index += 1
-%>
set spec[user = '<%= user %>'][<%=index%>]/user <%= user %>
set spec[user = '<%= user %>'][<%=index%>]/host_group/host ALL
set spec[user = '<%= user %>'][<%=index%>]/host_group/command '<%= scope.lookupvar('foreman_proxy::puppetrun_cmd') %> *'

This file has been truncated. show original

Matt_Cahill · June 12, 2018, 4:17am

Just put it in another file next to the foreman-proxy file that puppet doesn’t know about. We use another module to deploy the config. Snippit:

gist.github.com

https://gist.github.com/matt-cahill/0e2298201c967606cdaac651a5391c6a

foreman_cluster_snippit.pp

    user { "${foreman_proxy::mcollective_user}":
      ensure     => present,
      comment    => 'mcollective puppetrun user',
      home       => "/home/${foreman_proxy::mcollective_user}",
      managehome => true,
      shell      => '/bin/false',
    }
    file { "/home/${foreman_proxy::mcollective_user}/.puppetlabs":
      ensure  => directory,
      require => User["${foreman_proxy::mcollective_user}"],

This file has been truncated. show original

ekohl · June 12, 2018, 10:19am

We should probably modify the puppet module to set up the sudo line around here for the mcollective provider as well:

github.com

theforeman/puppet-foreman_proxy/blob/f030743ae4c0c9a75ae60336fbf2bcae3b4b954a/templates/sudo.erb#L4-L6


<% if scope.lookupvar("foreman_proxy::puppet") and scope.lookupvar("foreman_proxy::puppetrun_provider") == 'puppetrun' -%>
<%= scope.lookupvar("foreman_proxy::user") %> ALL = (<%= scope.lookupvar("foreman_proxy::puppet_user") %>) NOPASSWD : <%= scope.lookupvar("foreman_proxy::puppetrun_cmd") %> *
<% end -%>

Matt_Cahill · June 18, 2018, 5:25am

Yeah I meant to put something together for that and make a PR. I’ll do it as soon as I can.

Conzar · October 16, 2018, 3:12am

Probably not worth doing as MCO has been deprecated in puppet 6. I guess we should start looking at Bolt!

Matt_Cahill · October 16, 2018, 4:14am

Choria isn’t going away though so may be worth keeping it in depending on how many move over to keep the functionality. https://choria.io/

Bolt will be cool if we don’t have to put shared ssh keys in admin accounts everywhere, I believe it supports kerberos.