Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

require TLS by default #1529

Merged

Conversation

pstorz
Copy link
Member

@pstorz pstorz commented Aug 15, 2023

Thank you for contributing to the Bareos Project!

Please check

  • Short description and the purpose of this PR is present above this paragraph
  • Your name is present in the AUTHORS file (optional)

If you have any questions or problems, please give a comment in the PR.

Helpful documentation and best practices

Checklist for the reviewer of the PR (will be processed by the Bareos team)

Make sure you check/merge the PR using devtools/pr-tool to have some simple automated checks run and a proper changelog record added.

General
  • Is the PR title usable as CHANGELOG entry?
  • Purpose of the PR is understood
  • Commit descriptions are understandable and well formatted
  • Check backport line
  • Required backport PRs have been created
Source code quality
  • Source code changes are understandable
  • Variable and function names are meaningful
  • Code comments are correct (logically and spelling)
  • Required documentation changes are present and part of the PR
Tests
  • Decision taken that a test is required (if not, then remove this paragraph)
  • The choice of the type of test (unit test or systemtest) is reasonable
  • Testname matches exactly what is being tested
  • On a fail, output of the test leads quickly to the origin of the fault

@pstorz pstorz force-pushed the dev/pstorz/master/tls-require-yes-default branch 2 times, most recently from ea2f45a to 61667e0 Compare August 24, 2023 08:04
@bruno-at-bareos
Copy link
Contributor

Upstream Python is maybe making effort in having finally TLS-PSK supported in native ssl module
See python/cpython#103181

Copy link
Member Author

@pstorz pstorz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove the remains of
TLS Require = no following
TLS Enable = no as this is not required anymore.

@@ -40,7 +40,7 @@ messages
list jobs
@$out $log_home/should-hang.out
restore client=bareos-fd fileset=SelfTest where=$tmp/bareos-restores select all done yes
@sleep 3
@sleep 10
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we really need to wait for 10 seconds here?

@arogge arogge changed the title tls config: make TLS Require default to yes require TLS by default Sep 21, 2023
@arogge arogge force-pushed the dev/pstorz/master/tls-require-yes-default branch from 52d5254 to 65b2001 Compare September 21, 2023 14:25
pstorz and others added 19 commits September 22, 2023 12:07
As the default now is `TlsRequire = Yes`, this commit sets TlsRequire to
No in the configuration files for this test.
As Tls Require now defaults to yes, we need to set it to no to make the
test work.
Previously, when setting `TLS Require = yes` this would implicitly also
set `TLS Enable = yes`.
Since both, `TLS Enable` and `TLS Require` now default to yes, this
would mean that to disable TLS you have to set both `TLS Enable = no`
and `TLS Require = no`.
Thus patch changes the behaviour, to make `TLS Enable = no` also imply
`TLS Require = no`.

The most common scenarios don't require any configuration change, as the
effect is unchanged. In the improbable case where you had configured
Bareos like this:
```
TLS Enable = no
TLS Require = yes
```
The old behaviour was to have TLS enabled and required, while the new
behaviour is now to have TLS disabled.
@BareosBot BareosBot force-pushed the dev/pstorz/master/tls-require-yes-default branch from 59900e4 to 9e66fc3 Compare September 22, 2023 12:07
@BareosBot BareosBot merged commit 86b6a42 into bareos:master Sep 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants