6 Feb
2019
6 Feb
'19
9:44 a.m.
Module: check_mk
Branch: master
Commit: 1169611baeb2db7378d9ee238fe7d61433395fd9
URL:
http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=1169611baeb2db…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Thu Dec 27 21:18:08 2018 +0100
7017 Livestatus via TCP can now be encrypted
Livestatus has been a plain text protocol since it's invention. This is
normally OK for system local connections via unix socket or TCP connections
in secure networks.
Users always had the choice to secure the communication using TLS (e.g.
via stunnel), SSH, VPN or some other solution that encrypts the
communication in their local setup.
To improve the security for all users of Check_MK, we have now changed
the Livestatus TCP communication to be encrypted by default using TLS.
This is realized using an internal CA and internally generated
certificates.
Existing sites that already have Livestatus via TCP enabled before
updating to 1.6 still use the unencrypted communication for
compatibility. An analyze configuration" test will create a CRITICAL
message about the unencrypted Livestatus TCP configuration in this
situation.
Technical details:
<ul>
<li>For new sites Livestatus via TCP is encrypted by default. Existing sites
which already have Livestatus via TCP enabled during the update keep the
communication unencrypted for compatibility reasons. This is managed using
the new 'omd config' option LIVESTATUS_TCP_TLS. This setting can also
be managed through the "Global Settings > Site Management".</li>
<li>During update or site creation a site local CA certificate is created
to manage the sites local certificates.</li>
<li>The site local certificate is created automatically during update or
site creation.</li>
<li>The sites local CA and certificates are stored in 'etc/ssl'. The CA
certificate is always located at 'etc/ssl/ca.pem'.</li>
<li>The keys are 2048 bit RSA keys and the certificates are signed using
SHA512.</li>
<li>The CA certificate is valid for 10 years, the site certificates are
valid for 3 years.</li>
<li>Check_MK / OMD code may use 'omdlib.certs.SiteLocalCA(site_id)' to
use the local CA</li>
<li>stunnel is introduced as site internal daemon that serves the TLS
wrapped socket once it has been enabled through 'omd config'.
</ul>
CMK-1535
Change-Id: I3f33668c9b000c8d4a4186a853dc163c567a8ee3
---
.werks/7017 | 51 +++++++
cmk/gui/plugins/wato/ac_tests.py | 32 ++++
cmk/gui/watolib/config_domains.py | 3 +
cmk/gui/watolib/sites.py | 14 +-
omd/Makefile | 1 +
omd/packages/mk-livestatus/LIVESTATUS_TCP_TLS | 29 ++++
omd/packages/mk-livestatus/mk-livestatus.make | 1 +
omd/packages/omd/omdlib/certs.py | 161 +++++++++++++++++++++
omd/packages/omd/omdlib/main.py | 29 ++++
omd/packages/packages.make | 1 +
omd/packages/stunnel/skel.permissions | 1 +
omd/packages/stunnel/skel/etc/init.d/stunnel | 84 +++++++++++
omd/packages/stunnel/skel/etc/logrotate.d/stunnel | 7 +
omd/packages/stunnel/skel/etc/rc.d/85-stunnel | 1 +
omd/packages/stunnel/skel/etc/stunnel/server.conf | 12 ++
omd/packages/stunnel/stunnel.make | 12 ++
tests/integration/omd/test_hooks.py | 1 +
tests/integration/omd/test_init_scripts.py | 1 +
.../cmk/gui/watolib/test_analyze_configuration.py | 1 +
tests/unit/omdlib/test_certs.py | 78 ++++++++++
tests/unit/omdlib/test_omdlib_main.py | 12 ++
21 files changed, 531 insertions(+), 1 deletion(-)
Diff:
http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=1169611bae…