https://www.puppet.com/community logo
Join Slack
Powered by
# puppet
  • w
    I've been executing this against Ubuntu 20.04 LTS
  • n
    Note that passwords for linux user accounts shouldn’t be the plaintext password. But should be the hashed/salted form of the password.
  • w
    ahhhhhhhhhh
  • w
    ah ok, I see that when I go to the user type on puppet.
  • w
    Thank you, wasn't mentioned in the Account Module (I guess It's assumed someone's already aware of that caveat)
  • w
    How can I verify eyaml properties are being properly decrypted?
  • g
    i usually use 
    puppet lookup
    on a puppetmaster
  • n
    Yup, 
    puppet lookup
    from the command line or just a 
    notify
    resource in your code that prints out the value.
  • w
    could you provide an example that would print out the value for $user_password /
  • g
    sudo puppet lookup account_svcansiblelocal::user_password
  • n
    Copy code
    notify { 'user_password':
  message => "The user_password is: ${user_password}",
}
  • g
    you might need to specify 
    --node
    or 
    --environment
    depending
  • w
    thanks! now to debug
  • w
    oof yeah, it's not decrypting the values.
  • w
    here's my site level hiera.yaml
    Copy code
    ---
version: 5

defaults:
  datadir: "hieradata"

hierarchy:
  - name: "Yaml backend"
    data_hash: yaml_data
    paths:
      - "nodes/%{trusted.certname}.yaml"
      - "common.yaml"
  - name: "EYaml Backend"
    lookup_key: eyaml_lookup_key # eyaml backend
    paths: 
      - 'secrets.eyaml'
    options:
      pkcs7_private_key: /etc/puppetlabs/puppet/keys/private_key.pkcs7.pem 
      pkcs7_public_key: /etc/puppetlabs/puppet/keys/public_key.pkcs7.pem
  • d
    ```- took a hit! Ouch. (Karma: -85)
  • w
    module level
    Copy code
    ---
version: 5

defaults:  # Used for any hierarchy level that omits these keys.
  datadir: data         # This path is relative to hiera.yaml's directory.
  data_hash: yaml_data  # Use the built-in YAML backend.

hierarchy:
  - name: "osfamily/major release"
    paths:
        # Used to distinguish between Debian and Ubuntu
      - "os/%{facts.os.name}/%{facts.os.release.major}.yaml"
      - "os/%{facts.os.family}/%{facts.os.release.major}.yaml"
        # Used for Solaris
      - "os/%{facts.os.family}/%{facts.kernelrelease}.yaml"
  - name: "osfamily"
    paths:
      - "os/%{facts.os.name}.yaml"
      - "os/%{facts.os.family}.yaml"
  - name: 'common'
    path: 'common.yaml'
  • d
    ```- lost a life. (Karma: -86)
  • n
    sudo puppet lookup account_svcansiblelocal::user_password --node <http://vmpuppetmaster01.britanniahome.net|vmpuppetmaster01.britanniahome.net> --environment test --explain
  • w
    -_- first time I closed with backticks, second time I diddn't
  • n
    What does the encrypted data look like in 
    secrets.yaml
  • w
    Site level is null
  • g
    yeah 
    --explain
    can help a ton here
  • w
    Error: Could not run: No facts available for target node: vmpuppetmaster01.britanniahome.net
  • n
    Your encrypted secret has to exist in the environment-level 
    secrets.eyaml
    file for it to be decrypted (based on your Hiera config)
  • n
    Your encrypted secret has to exist in the environment-level 
    secrets.yaml
    file for it to be decrypted
  • n
    Your encrypted secret has to exist in the environment-level 
    secrets.yaml
    file for it to be decrypted (based on your Hiera config)
  • g
    yeah you'll need to adjust that node option to have a hostname of a node that's puppetized from this puppet primary server in the past
  • n
    Try just 
    sudo puppet lookup account_svcansiblelocal::user_password --environment test --explain
  • n
    Try just 
    sudo puppet lookup account_svcansiblelocal::user_password --environment test --explain
1...215216217...428Latest