how to require a md5sum before installing?

[Andy Spiegl]

Hi,

I've got several modules which grab installer files from a network
share. The share is readonly and as well protected as possibly.
But still, I have a bad feeling about it and would like to introduce
an extra layer of security. Like checking the md5sum of the file
before running the installer.

I thought about have a require line similar to
require => md5['cdfb294489a14305ca729cc13fe10d52'],

Any ideas?

Thanks,
Andy.

--
It is no coincidence that in no known language
does the phrase 'As pretty as an Airport' appear.
(Douglas Adams)

[Klavs Klavsen]

My solution to that, has been to use a packaging system. RPM etc. all check md5sum (and PGP check against upstream signature) - so I insist on rolling everything binary, on as packages, and use only 1 packaging system per host (ie. gems etc. get repackaged to rpm, deb or whatever).

[Andy Spiegl]

> My solution to that, has been to use a packaging system.

Thanks, that's a good solution!

For my windows clients I need something different, though. :-(
Apparently there is no solution yet. How would I go about writing a
plugin myself? Unfortunately I'm still too new to puppet...

Thanks,
Andy.

--
Did you know: Women blink nearly twice as much as men.

[Rafael Cristaldo]

Hi Andy!

I know a module that download packages (tar.gz) for example, and make MD5 check on it!.
Maybe you may download it and analyse the manifests to understand how to do MD5 on your modules!

 http://forge.puppetlabs.com/gini/archive

I have used it! with my módules, create my packages and the MD5 of them..and it works!

[Andy Spiegl]

Hi Rafael,

> http://forge.puppetlabs.com/gini/archive
Thanks, I'll try that! Sounds promising.
Now I only have to find a way to securely get md5sum.exe onto the
machines, uhm...

Thanks!
Andy.


--
Every generation laughs at the old fashions
but religiously follows the new. (Henry David Thoreau, US philosopher)

[Rafael Cristaldo]

Hi Andy..

Tell me more about your goal!

What you really need!?

Are your client Windows or Linux ?

--

Rafael Cristaldo

Analísta de Suporte

FPTI - Parque Tecnológico Itaipu
LPIC-3 Senior Level Linux Certification

LPI ID; LPI000238085 Cod: 4ackegjqlx

[Andy Spiegl]

> Tell me more about your goal!
>
> What you really need!?
>
> Are your client Windows or Linux ?

Most of them are Linux, but many user workstations are Windows.
I am trying to set up puppet to update the most security crucial
programs on these Windows machines: Java, Flash, Firefox, Thunderbird,
putty, vlc and puppet itself of course.

I've got a separate module for each which grab installer files from a
samba share. The share is readonly but we have a bad feeling about it

and would like to introduce an extra layer of security. Like checking

the md5sum of the file before running the installer on the clients.

The module you mentioned (gini-archive) sounds very practical, but if
I distribute md5sum.exe to the windows clients using the same puppet
method, I don't really gain security. :-)

Thanks,
Andy.


--
If you take USABLE from UNSTABLE you get NT.

[Rafael Cristaldo]

Hi Andy...

I think i got your idea....

I use this module ARCHIVE with Linux workstations, and the módule I created was to install our ERP system, so i use the ARCHIVE do download the package tar.gz from our FTP server, for example:

url => 'http://ftp.company.com/puppet/system.tar.gz'

So, with this tarball, i have the system.tar.gz.md5, where i did with the command on linux md5sum to create the md5 file.

With THIS the ARCHIVE module make all to me!!

It download the tarball, extract it to the target /usr/local , check with MD5 and install my ERP.

You are using samba to distribute the programs .exe, so you can create the md5 file, and use the ARCHIVE module to install the package...

Take a look at this module with your module...

[Andy Spiegl]

Hi Rafael,

> It download the tarball, extract it to the target /usr/local , check
> with MD5 and install my ERP.

Windows doesn't have md5sum functionality built in. I have to get
md5sum.exe to the machine somehow.

The ARCHIVE module uses curl, rm, tar, unzip, ...
Lots of unix tools. :-(

Thanks,
Andy.

--
It's like shearing a pig – lots of screams but little wool. (Putin, 2013)