Re: CFEngine Help: Re: Thoughts of encrypting the entire Cfengine workspace?

2012-04-30 Thread Christopher Browne
On Mon, Apr 30, 2012 at 11:09 AM, Nick Anderson wrote: > On 04/30/2012 09:45 AM, no-re...@cfengine.com wrote: >> No, not at all, because no matter what you do, the local cf-agent >> has to decrypt the policy, and that means it's vulnerable to a >> person with root access.  Even if cf-agent only ge

Re: Master to client security, signing?

2011-12-22 Thread Christopher Browne
On Thu, Dec 22, 2011 at 2:20 PM, Mark Burgess wrote: > I like your analogy of the poisoned stream.  :-)  However, taking over a > properly maintained signature is a much smaller vector than gaining access > to the headwaters (especially if you have several people manning the > pumps).  If the sign

Re: CFEngine Help: New Book on Cfengine

2011-12-13 Thread Christopher Browne
2011/12/13 Ted Zlatanov : > I reviewed some Packt books (SimpleDB, Cassandra, Perl, and other > topics) and could not write too many positive things.  Besides spelling > and layout problems, the content was just not very good.  So this is not > a problem with just the CFEngine book from them, in my

Re: Cfengine Help: Re: Running a command just once.

2011-05-06 Thread Christopher Browne
On Fri, May 6, 2011 at 1:24 PM, Jerome Baum wrote: > I am still worried whether cfengine is the right tool for this. It's not > that I want to keep bringing the system into the "database has exactly > as its content" state -- I just initially want to get it there. So, I > am trying to converge to

Re: Cfengine Help: Re: Running a command just once.

2011-05-06 Thread Christopher Browne
On Fri, May 6, 2011 at 12:05 PM, wrote: > Forum: Cfengine Help > Subject: Re: Running a command just once. > Author: jeromebaum > Link to topic: https://cfengine.com/forum/read.php?3,21797,21800#msg-21800 > > Was just working on a config today. Part of it was "create a database w/ its > tables,

Re: detecting new IP address?

2011-04-11 Thread Christopher Browne
On Sun, Apr 10, 2011 at 2:42 PM, Jesse Becker wrote: > Here's a question:  how does one detect a *new* IP address getting added > to a system? > > For example, if there's some mecahnism for bringing up a new interface > (such as failover/heartbeat mechanism), is there a way to detect this? > I sup

Re: Cfengine Help: Re: Cfengine Help: Re: Running cf-serverd as non-root

2011-03-15 Thread Christopher Browne
On Tue, Mar 15, 2011 at 1:59 PM, Mike Hoskins wrote: > Having said that, let's consider least privilege for a minute.  If your > cfengine hosts are locked down in accordance with best practices, they > will not be hosting other services (and likely in a DMZ).  If someone > compromises cfservd, the

Re: What SVN hooks do you use in pre-commit / post-commit?

2011-01-28 Thread Christopher Browne
ould be possible. You don't > want to have to vote on every individual commit at a time, and some > patches will "depend" on other patches. That could get ugly... So there are "weak commits," going to dev branch, which get promoted to the 'prod branch.' The

Re: Cfengine Help: Re: How do you start cfengine?

2010-03-31 Thread Christopher Browne
ld certainly be an easy SQL query, especially for a department of DBAs :-). -- let name="cbbrowne" and tld="ca.afilias.info" in name ^ "@" ^ tld;; Christopher Browne "Bother," said Pooh, "Eeyore, ready two photon torpedoes and lock phasers on the

Re: editing old school cron tables

2010-03-04 Thread Christopher Browne
- If the file changed, archiving the old copy somewhere (so I've got at least loose "version control" as to what changed when) - crontab < $file -- "cbbrowne","@","ca.afilias.info" Christopher Browne "Bother," said Pooh, "Eeyor

Re: challenge: last Saturday of the month

2010-03-03 Thread Christopher Browne
_Saturday" expression => "Saturday.((Day31|Day30|Day29|Day28|Day27|Day26|Day25)|(Day24.(April|June|September|November)|(Day23.February)|(Day22.February.!LeapYear)))"; -- let name="cbbrowne" and tld="ca.afilias.info" in String.concat "@" [name;tld

Re: Master policy files on NFS

2010-01-27 Thread Christopher Browne
e of NFS. -- let name="cbbrowne" and tld="ca.afilias.info" in name ^ "@" ^ tld;; Christopher Browne "Bother," said Pooh, "Eeyore, ready two photon torpedoes and lock phasers on the Heffalump, Piglet, meet me in transporter room three" _

Re: modular policies

2009-12-10 Thread Christopher Browne
providing ways to separate data from model, as that allows the data to scale to larger sizes without that making the model worse. -- select 'cbbrowne' || '@' || 'ca.afilias.info'; Christopher Browne "Bother," said Pooh, "Eeyore, ready two photon torpedoes and

Re: cf3 svn(646-648) Berkeley DB_NOTFOUND

2009-12-01 Thread Christopher Browne
ace central for analysis. -- "cbbrowne","@","ca.afilias.info" Christopher Browne "Bother," said Pooh, "Eeyore, ready two photon torpedoes and lock phasers on the Heffalump, Piglet, meet me in transporter room three" _

tidy fails - "can't stat [some file]"

2006-05-24 Thread Christopher Browne
I'm getting cases where old files that *ought* to be purgeable are failing to be tidied out by the tidy: section. For each such file, I'm getting error messages thus: Can't stat backup1.2006-05-15.gpg (/opt/escrow/info/backups/backup1.2006-05-15.gpg) Can't stat backup1.2006-05-24.gpg (/opt/escr