Foreman » Smart Proxy

h1. SSL setup

The smart proxy can work in SSL mode, where both sides verify and trust each other.

h2. Configure SSL certificates

This request will only be accepted if the SSL certificates match. Therefore the client's private key grants access to proxy's funtionality, so protect it.

As this tool is meant to interoperate with a puppet installation I suggest that you use the Certificate Authority provided by a puppet server as your CA.

# Login to your puppetmaster, which has a Certificate Authority

# Use the puppet tools to create a new certificate

<pre><code>

  puppetca --generate <proxy-FQDN>

</pre></code>

# Copy the certificate keys to your Windows host

<pre><code>

    scp puppetmaster:/var/lib/puppet/ssl/ca/signed/<proxy-FQDN>.pem signed.pem

    scp puppetmaster:/var/lib/puppet/ssl/private_keys/<proxy-FQDN>.pem private.pem

</pre></code>

# Copy the ssl/certs/ca.pem from any puppet client to the smart-proxy\config directory. This ensures that the proxy trusts the same CA as a puppet client.

*Example 2:*

The above instructions kind of confused me.  I think they are for when you are trying to use smart-proxy on a system that isn't normally managed by puppet but you want to use the puppet CA.

In my instance my smart-proxy was already managed by puppet, so certs already existed on the system.  My puppet certdir was /etc/puppet/ssl so I just had to edit the smart-proxy settings.yml (/etc/foreman-proxy/settings.yml on my system) to reference the paths:

SNIPPET of settings.yml:

<pre>

---

# SSL Setup

# if enabled, all communication would be verfied via SSL

# NOTE that both certificates need to be signed by the same CA in order for this to work

# see http://theforeman.org/projects/smart-proxy/wiki/SSL for more information

:ssl_certificate: /etc/puppet/ssl/certs/FQDN.pem

:ssl_ca_file: /etc/puppet/ssl/certs/ca.pem

:ssl_private_key: /etc/puppet/ssl/private_keys/FQDN.pem

# the hosts which the proxy accepts connections from

# commenting the following lines would mean every verified SSL connection allowed

:trusted_hosts:

- foreman.corp.com

#- foreman.dev.domain

</pre>

Of course if you have a smart-proxy module in puppet to module your smart-proxies you can template it out like:

<pre>

:ssl_certificate: /etc/puppet/ssl/certs/<%25= @fqdn %25>.pem

:ssl_ca_file: /etc/puppet/ssl/certs/ca.pem

:ssl_private_key: /etc/puppet/ssl/private_keys/<%25= @fqdn %25>.pem

:trusted_hosts:

- <%25= foreman_server %25>

</pre>

h2. Troubleshooting

<pre>

Unable to save

Unable to communicate with the proxy: No such file or directory - /.puppet/var/ssl/certs/foremanserver.domainname.corp.pem

Please check the proxy is configured and running on the host before saving.

</pre>

Workaround

# mkdir /.puppet

# ln -s /var/lib/puppet/ /.puppet/var

# add foreman, foreman-proxy to puppet group

# chmod -R 640 /var/lib/puppet/ssl/private_keys

# chgrp -R puppet /var/lib/puppet/ssl/private_keys

# 

*Example 2:*

I also ran into this issue ... here is my breakdown of it.

This seems to stem from the foreman webserver needing access to it's certificate.  It looks for it down the webuser home directory for .puppet which somewhat is supposed to mimic the puppetdir.

So for my SLES system which:

* Webuser - wwwrun

* Webuser homedir - /var/lib/wwwrun

* Puppet dir - /etc/puppet

Looks in /var/lib/wwwrun/.puppet/ssl/certs

So I needed to:

<pre>

add wwwrun to puppet group

cd /var/lib/wwwrun

ln -s /etc/puppet .puppet

chgrp -R puppet /etc/puppet/ssl/private_keys

chmod 640 /etc/puppet/ssl/private_keys/*

</pre>