Category: puppet

Feed: Puppet.com Blog RSS Feed. Author: ; Github protocol changes and Puppet code deploymentGitHub is in the process of improving Git protocol security by removing insecure DSA keys and legacy ciphers, updating requirements on RSA keys, and adding more secure key signature algorithms ECDSA and ED25519. On January 11, GitHub ran a planned brownout event day to shake out affected clients. Our team at Puppet discovered that many users of Code Manager and r10k were affected by this change. Code Manager and r10k both use libgit2 version 1.9.0, which doesn't yet support the upgraded security of RSA with SHA-2. GitHub ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; Log4j, the popular open-source logging library, had a rough December and closed out the year with an impressive streak of four critical vulnerabilities so far. Many are calling this the worst cybersecurity event in history. Again, so far. Some of the vulnerabilities affect the default configuration, so vendors using the library are scrambling to patch their products, and system admins worldwide are frantically scanning their infrastructures, hoping to find vulnerable servers before malicious actors do. This is made more complicated by the way Java packages the libraries used by an application. Instead of ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; The CIS suite from PuppetPuppet's suite of products offers a three step approach to ensuring and proving CIS Benchmark compliance: Puppet Comply: Puppet Comply includes the CIS scanner to determine compliance on each managed node in your Puppet estate. Puppet Comply allows you to scan against each CIS Benchmark, and to customize Benchmarks to assess real-work implementations of Benchmarks, including recommended Controls that simply aren't practical (e.g. a legacy system where telnet is required). This allows you to document and track accepted exceptions to specific Controls and demonstrate compliance against these tailored Benchmarks ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; Red Hat Satellite and Puppet Users of Red Hat Satellite will see changes coming out with regard to how Satellite interacts with Puppet. Satellite has long bundled Puppet in the distribution, using Puppet both as the Satellite installer and for configuration management. Users also had the option to leverage Satellite as an External Node Classifier (ENC) for their Puppet estates. Red Hat acquired Ansible, an imperative configuration management tool, in late 2015. Starting in version 6.9, the use of Satellite as a Puppet ENC was deprecated along with most of the other supported ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; Let's rip off the bandaid and get the bad news out there first: we're rolling out telemetry for Puppet content. Read on to find out why I think that's actually good news for you, how you can see exactly what data it collects, and how to make sure it never runs if your corporate policy doesn't allow it. And maybe a free beanie if you choose to opt in?Why we decided to roll out a telemetry client I'll start out with the problems we are trying to solve. You've probably seen me in ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; Puppet Response to Log4j Remote Code Execution Vulnerabilities CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105December 20, 2021 Update: On December 20, in response to a new log4j vulnerability CVE-2021-45105, we released Continuous Delivery for Puppet Enterprise version 4.10.5 with Apache Log4j 2.17.0. December 17, 2021 Update: The severity of CVE-2021-45046, the fix to address CVE-2021-44228 in Apache Log4j 2.15.0, has been changed from medium to critical. In response, we have released Continuous Delivery for Puppet Enterprise (CD for PE) version 4.10.4 with Apache Log4j 2.16.0. We still do not believe that CD for PE is vulnerable ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; Puppet Response to CVE-2021-44228 and CVE-2021-45046December 17, 2021 Update: The severity of CVE-2021-45046, the fix to address CVE-2021-44228 in Apache Log4j 2.15.0, has been changed from medium to critical. In response, we have released Continuous Delivery for Puppet Enterprise (CD for PE) version 4.10.4 with Apache Log4j 2.16.0. We still do not believe that CD for PE is vulnerable given the log4j configuration and mitigation, but want to provide our users with the most up-to-date software possible as the situation evolves. If you are a Continuous Delivery for PE customer running version 3.x, ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; If you're looking to enforce CIS benchmarks with Puppet Compliance Enforcement Modules, click here.Enforcing CIS benchmarks on Linux using Open Source Puppet CIS (Center for Internet Security) is a non-profit organization that aims to develop a best practice in relation to cyber security. The CIS benchmarks have been adopted by many organizations as the standard against which to measure their systems. You can download a copy of the CIS standards for free from CIS Security; if you do, you'll see the high number of benchmarks. For example, for CentOS 7 there are 186 ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; One of the more popular sessions from PuppetConf 2013 was James Sweeny's talk, "Managing Windows with Puppet." James provides some pragmatic tips for how Windows can be managed effectively and easily with Puppet, and compares and contrasts the differences between managing Linux and Windows environments. He then goes into some of the specific approaches that are unique to Windows resources, as well as some of the weird Windows idiosyncrasies that will probably hurt you if you're not careful. Check out the full transcript of James' talk. Learn More See how rebooting Windows has ... Read More

Feed: Puppet.com Blog RSS Feed. Author: ; The Puppet team would like to express our appreciation to our amazing sponsors for being a part of Puppetize Live. We couldn’t have done this without your support A special thank you to our headline sponsor, AWS, for their main stage and live stream talks on utilizing Puppet and AWS OpsWorks. Another set of thank yous go out to Google Cloud and Splunk for being a part of both the main stage and live stream experiences as our platinum sponsors. We’d also want to give a huge thank you to our gold, silver ... Read More