[chef] Re: Re: Re: Re: RE: RE: Re: RE: Re: Chef client for Ubuntu 14.04

[Daniel DeLeo < >]

On Friday, May 8, 2015 at 4:58 PM, Ranjib Dey wrote:

> i dont think so. its a serious security malpractice, its better if people 
> opt in for disabling check.
>  
> On Fri, May 8, 2015 at 4:44 PM, Nico Kadel-Garcia 
> <
 
>  
> (mailto:
 )>
>  wrote:
> > Since very, very few servers have signed certificates, shouldn't this 
> > check be turned off by default?
> >  
> > Nico Kadel-Garcia
> > Email: 
> > 
 
> >  
> > (mailto:
 )
> > Sent from iPhone
>  

100% Agree with Ranjib. When downloading code, potentially over the public 
internet, and running it as root, you need to take every precaution against a 
MITM attack.

We’ve put a ton of effort into making it easy to do the right thing. OpenSSL 
errors are usually incomprehensibly vague, so we wrote `knife ssl check` 
which can pull the SSL cert from an SSL connection and generally tell you 
exactly why it’s not valid (and we’ll update this for new cases as we find 
them and learn how to repro). Using the same mechanism, we can store the 
certs from the server locally, which won’t help if you’re already the victim 
of a MITM (we recommend you SSH into your Chef Server and compare the cert’s 
checksum), but will protect you from any future MITM attempt. We’ve also 
integrated this with `knife bootstrap` so that when you spin up new servers, 
we automatically copy your self-signed cert to the new machine, so it’s 
automatically able to verify the server certificate.

--  
Daniel DeLeo