# voxpupuli
- v
VoxBot
02/21/2023, 11:22 AMgetting closer to being able to use puppet-lint 3.0 :) - v
VoxBot
02/21/2023, 11:24 AMmhm how do I configure theforeman/puppet on a puppetserver to connect to a foreman with TLS client cert/key - v
VoxBot
02/21/2023, 11:25 AMtheforeman/puppetserver_foreman supports '' as values, but theforeman/puppet doesnt - v
VoxBot
02/21/2023, 11:26 AMhuh? I don't quite get what you're suggesting - v
VoxBot
02/21/2023, 11:26 AMwhich parameters? - v
VoxBot
02/21/2023, 11:27 AMserver_foreman_ssl_cert and server_foreman_ssl_key - v
VoxBot
02/21/2023, 11:28 AMwhat would '' mean? isn't that essentially "without TLS", instead of "with TLS"? - v
VoxBot
02/21/2023, 11:31 AMthat should be 'with TLS but without client TLS' - v
VoxBot
02/21/2023, 11:31 AMah, now I'm starting to get it - v
VoxBot
02/21/2023, 11:32 AMforeman uses a TLS chain from another CA, not from Puppet CA - v
VoxBot
02/21/2023, 11:32 AMand you disabled TLS auth on Foreman somehow? - v
VoxBot
02/21/2023, 11:32 AMthis is an old setup where a cron uploads reports from a puppetserver to foreman - v
VoxBot
02/21/2023, 11:32 AMI assume someone else did that - v
VoxBot
02/21/2023, 11:34 AMah mhm, or maybe not - v
VoxBot
02/21/2023, 11:35 AMthe ssl_cert and ssl_key options are not set in /etc/puppetlabs/puppet/foreman.yaml - v
VoxBot
02/21/2023, 11:35 AMdoes that mean tls client cert isn't used, or are there some defaults hardcoded - v
VoxBot
02/21/2023, 11:36 AMah the foreman.rb doesn't do tls client cert foo when it's not set in the config - v
VoxBot
02/21/2023, 11:36 AMso I'm sure there is no client cert authentication in foreman enabled - v
VoxBot
02/21/2023, 11:37 AMI'm trying to convert this manual setup to theforeman/puppet + theforeman/puppetserver_foreman - v
VoxBot
02/21/2023, 11:37 AMthat's weird - sounds like a potential security hole - v
VoxBot
02/21/2023, 11:40 AMI wonder what's in the Apache config of the Foreman server - v
VoxBot
02/21/2023, 11:47 AMthe apache config has sslverifyclient optional - v
VoxBot
02/21/2023, 11:49 AMsslcacertificatefile is set to the ca-certificates truststore, sslcarecovationfile is set to the puppet ca CRL. that looks odd - v
VoxBot
02/21/2023, 11:49 AMmaybe the puppet CA was added to the global truststore - v
VoxBot
02/21/2023, 11:50 AMoh, that was something we had a LONG time ago, but it essentially means that any certificate signed by something in the truststore can be used to authenticate - v
VoxBot
02/21/2023, 11:51 AMah - v
VoxBot
02/21/2023, 11:51 AM - v
VoxBot
02/21/2023, 11:51 AMit's foreman 3.4.1, so not really old - v
VoxBot
02/21/2023, 11:52 AM2016, 7 years ago … - v
VoxBot
02/21/2023, 11:53 AMI'm tempted to just update the foreman.yaml and see what fails