-
Notifications
You must be signed in to change notification settings - Fork 70
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
IPv6 is not working still if its enabled #140
Comments
Thanks @artem-sidorenko that is a great idea |
Question to the handling of such defaults, which depend on another attribute with a default value. In chef-os-hardening a problem like this is solved like: default['network']['ipv6']['enable'] = false
default['ssh']['listen_to'] = if node['network']['ipv6']['enable']
['0.0.0.0', '::']
else
['0.0.0.0']
end The attribute files are loaded by chef in the run list order prior to the compilation of recipes. So basically in this implementation we do have only one way to change the
In the end, its possible to change the defaults of attributes depending on other attributes only in the 3rd case: via I see following option - we move attributes like
@chris-rock @arlimus @atomic111 opinions? |
To save someone else the head scratching that I went through, this issue's changes mean that if you need to set the
This addresses the CIS and chef base/ssh compliance finding that sshd should not be listening to |
@rjhornsby I added a notice on the Its the common use case, but I do not think its a good idea to make it the default this way. It might break the ssh access to the box if |
I think it might help to have the example in the readme, or maybe some way to call out which attributes are set in recipes and must use I'm relatively new to Chef (~3 months), coming over from Puppet. I thought I read somewhere that using Is it good or common practice to use
I agree with you. Making the cookbook default to |
yeah, this was exactly the point of @atomic111 in the review of #148 :) However I personally do not like this idea: this adds another documentation layer and usually such things get unmaintained very fast and are often not up-to-date. What about to have a short hint on the attribute itself? Like this: Notice: Some of attribute defaults of this cookbook are set in the recipes. You should use a higher attribute precedence level for overriding of such attributes. Such attributes are flagged with `override attribute` in the list below. Example for overriding a such attribute:
override['ssh-hardening']['ssh']['server']['listen_to'] = node['ipaddress']
* `['ssh-hardening']['ssh']['server']['listen_to']` - `override attribute` - one or more ip addresses, to which ssh-server should listen to. Default is to listen on all interfaces. It should be configured for security reasons!
I see both things quite often (and you also have force_default etc). I see default[] as a common practice as it works in the most cases, however not for all. I use the |
+1, I like it. |
Based on this feeback: dev-sec#140 (comment)
Based on this feedback: dev-sec#140 (comment)
The default listen value blocks listening of sshd on IPv6 interfaces:
This default should react on the IPv6 setting and allow listening on IPv6 too
The text was updated successfully, but these errors were encountered: