Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not provide example integrations as classes #414

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

smortex
Copy link
Member

@smortex smortex commented Nov 5, 2024

The module configure PuppetBoard, but also has classes to setup Apache
configuration to serve it. Unfortunately, such configuration is very
site specific, and providing it in the module confuse users who discover
that their setup is exposed to the internet without authentication.

At some point, LDAP authentication was added which partially fix the
issue, but only for users who can authenticate their users with LDAP.

It is also quite common to use the Puppet CA to authenticate clients,
or use Passenger instead of wsgi, or use another web server than apache,
and any combination of this, making a generic solution not viable.

Remove all these apache-specific examples from the module classes, and
provide examples configuration for different setups. It will be easier
to add new integration examples by just dropping more files in the
example directory, without cluttering the module with complex mostly
private code.

The module configure PuppetBoard, but also has classes to setup Apache
configuration to serve it.  Unfortunately, such configuration is very
site specific, and providing it in the module confuse users who discover
that their setup is exposed to the internet without authentication.

At some point, LDAP authentication was added which partially fix the
issue, but only for users who can authenticate their users with LDAP.

It is also quite common to use the Puppet CA to authenticate clients,
or use Passenger instead of wsgi, or use another web server than apache,
and any combination of this, making a generic solution not viable.

Remove all these apache-specific examples from the module classes, and
provide examples configuration for different setups.  It will be easier
to add new integration examples by just dropping more files in the
example directory, without cluttering the module with complex mostly
private code.
@smortex
Copy link
Member Author

smortex commented Nov 5, 2024

Hopefully this will help to avoid the number of PuppetBoard instances exposed on the Internet to continue to be so common. Here is a report from shodan for the trend of the number of results for the search "http.title:puppetboard"

a screenshot showing between 7 and 22 results between may 2017 and september 2024

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant