[chef] Re: Securing Knife

[Brad Knowles < >]

On Nov 6, 2013, at 4:49 PM, "Kemp, Joseph A. (JKEMP)" 
<
 >
 wrote:

> My concern is with the pem file.  Right now it is basically like storing my 
> password in the clear in a text file.  I need to either add a password to 
> the private key or I need the chef-server to require the user password to 
> be provided before it allows access to the chef-server.  Why does the chef 
> server allow a user to perform operations against the server without the 
> user's password?

With ssh, there is ssh-agent that can be used to temporarily cache the 
password in memory, once it has been entered from the keyboard.  Through 
sshd_config, you can control how long they are cached before being purged.

If you're using "knife ssh ...", then I would expect that the ssh-agent would 
work the same for you as if you were typing a naked "ssh" command.

However, I don't know if there is an equivalent to ssh-agent for all the 
PEM-related things that might need to be done that do not actually use ssh.

--
Brad Knowles 
<
 >
LinkedIn Profile: <http://tinyurl.com/y8kpxu>