Personally I mitigate this by blocking root access via SSH+password as part of my initial puppet run (which I do during the installer).

However, it is something we should fix at some point. Perhaps we should add a Setting (default to Off) which is an array of IPs which are allowed to recieve externalnodes?

or maybe have a setting that only allow ip's from smart proxies with puppet feature?

I see two issues here:

1. The default configuration is insecure
All products should be shipped with secure defaults. This is not the case with foreman currently.
I also don't think that recent hashing algorithms work around the problem sufficiently, because by default foreman ships with a well known default password hash.
Whatever you say: this is not what I'd call secure by default.

2. There is no simple/obvious way to deny access to the YML
I googled the topic and there was no documentation available on how to limit access.
Also I haven't found a simple way to deny access. The Information is available through at least two different URLs, so URL pattern matching is probably not sufficient - I cannot be sure there isn't another URL I need to block.

Even if we choose to ship insecure by default, there should be a simple way to make this part of the system more secure.

For users updating and hitting this change, please see the following documentation:

• Release notes: Authentication for puppetmasters
• Manual: Securing Communications with SSL

We appreciate it's a difficult change, but is necessary to improve the security of the application. If you have problems, do check the troubleshooting text in the manual, and do contact one of the Support channels.