Table of Contents
controls/cf_serverd.cf
Table of Contents
This is where body server control
is defined. body server control
is where
various settings related to cf-serverd
can be tuned.
server bundles
access_rules
Prototype: access_rules
Implementation:
bundle server access_rules()
{
access:
any::
"$(def.dir_masterfiles)"
handle => "server_access_grant_access_policy",
shortcut => "masterfiles",
comment => "Grant access to the policy updates",
admit => { @(def.acl) };
"$(def.dir_software)"
handle => "server_access_grant_access_datafiles",
comment => "Grant access to software updates",
admit => { @(def.acl) };
"$(def.dir_bin)"
handle => "server_access_grant_access_binary",
comment => "Grant access to binary for cf-runagent",
admit => { @(def.acl) };
"$(def.dir_modules)"
handle => "server_access_grant_access_modules",
shortcut => "modules",
comment => "Grant access to modules directory",
admit => { @(def.acl) };
"$(def.dir_plugins)"
handle => "server_access_grant_access_plugins",
comment => "Grant access to plugins directory",
admit => { @(def.acl) };
"$(def.dir_templates)"
handle => "server_access_grant_access_templates",
shortcut => "templates",
comment => "Grant access to templates directory",
admit => { @(def.acl) };
enterprise_edition.policy_server::
"collect_calls"
resource_type => "query",
admit_ips => { @(def.mpf_access_rules_collect_calls_admit_ips) };
!windows::
"$(def.cf_runagent_shell)"
handle => "server_access_grant_access_shell_cmd",
comment => "Grant access to shell for cfruncommand",
admit => { @(def.policy_servers) };
policy_server.enable_cfengine_enterprise_hub_ha::
"$(sys.workdir)/ppkeys"
handle => "server_access_grant_access_ppkeys_hubs",
comment => "Grant access to ppkeys for HA hubs",
admit => { @(def.policy_servers) };
# Allow slave hub to synchronize cf_robot and appsettings content.
# Files are containing configuration that must be the same on all hubs.
"$(sys.workdir)/httpd/htdocs/application/config/cf_robot.php"
handle => "server_access_grant_access_cf_robot",
comment => "Grant access to cf_robot file for HA hubs",
admit => { @(def.policy_servers) };
"$(sys.workdir)/share/GUI/application/config/appsettings.php"
handle => "server_access_grant_access_appsettings",
comment => "Grant access to appsettings for HA hubs",
admit => { @(def.policy_servers) };
# Allow access to notification_scripts directory so passive hub
# will be able to synchronize its content. Once passive hub will
# be promoted to act as a master all the custom scripts will be
# accessible.
"/opt/cfengine/notification_scripts"
handle => "server_access_grant_access_notification scripts",
comment => "Grant access tonotification scripts",
admit => { @(def.policy_servers) };
# When HA is enabled clients are updating active hub IP address
# using data stored in master_hub.dat file.
"$(ha_def.master_hub_location)"
handle => "server_access_grant_access_policy_server_dat",
comment => "Grant access to policy_server.dat",
admit => { @(def.acl) };
# Hubs keys working in HA configuration are stored in ppkeys_hubs directory.
# In order to perform failover while active hub is down clients needs to
# have all hubs keys. This gives ability to connect to slave hub promoted to active role
# once active is down.
"$(ha_def.hubs_keys_location)"
handle => "server_access_grant_access_to_clients",
comment => "Grant access to hubs' keys to clients",
admit => { @(def.acl) };
windows::
"c:\program files\cfengine\bin\cf-agent.exe"
handle => "server_access_grant_access_agent",
comment => "Grant access to the agent (for cf-runagent)",
admit => { @(def.policy_servers) };
roles:
# Use roles to allow specific remote cf-runagent users to
# define certain soft-classes when running cf-agent on this host
".*" authorize => { "root" };
}
server bodies
control
Prototype: control
Implementation:
body server control
{
# List of ciphers the server accepts. For Syntax help see man page
# for "openssl ciphers". Default is "AES256-GCM-SHA384:AES256-SHA"
#allowciphers => "AES256-GCM-SHA384:AES256-SHA";
# List of hosts that may connect (change the ACL in def.cf)
allowconnects => { "127.0.0.1" , "::1", @(def.acl) };
# Out of them, which ones should be allowed to have more than one
# connection established at the same time?
allowallconnects => { "127.0.0.1" , "::1", @(def.acl) };
# Out of the hosts in allowconnects, trust new keys only from the
# following ones. SEE COMMENTS IN def.cf
trustkeysfrom => { @(def.trustkeysfrom) };
## List of the hosts not using the latest protocol that we'll accept connections from
## (absence of this option or empty list means allow none)
allowlegacyconnects => { @(def.control_server_allowlegacyconnects) };
# Maximum number of concurrent connections.
# Suggested value >= total number of hosts
maxconnections => "$(def.control_server_maxconnections)";
# Allow connections from nodes which are out-of-sync
denybadclocks => "false";
enterprise_edition.client_initiated_reporting_enabled::
call_collect_interval => "$(def.control_server_call_collect_interval)";
!policy_server::
allowusers => { "root" };
windows::
cfruncommand => "$(sys.cf_agent) -I -D cfruncommand -f \"$(sys.update_policy_path)\" &
$(sys.cf_agent) -I -D cfruncommand";
!windows::
# last single quote in cfruncommand is left open, so that
# arguments (like -K and --remote-bundles) are properly appended.
cfruncommand => "$(def.cf_runagent_shell) -c \'
$(sys.cf_agent) -I -D cfruncommand -f $(sys.update_policy_path) ;
$(sys.cf_agent) -I -D cfruncommand";
# Bind to all interfaces including ipv6
# Adding this on windows will force ipv6 only
bindtointerface => "::";
}