| R.I.Pienaar I think you meant "by default even reports should NOT be accessible? Scott Cyprus The reason for the path change is because the old parent directory /opt/puppetlabs/puppet/cache is not read/executable by other. So in order to make the last_run_summary.yaml readable by monitoring software, you'd have to relax the permissions on the parent cache as well. But that directory can contain sensitive information last_run_report.yaml, so a bigger change was required. The new public directory is read/executable by other, but the last_run_summary.yaml file is not readable, because we are following secure by default practices. If you are an advanced user and want to allow a specific user/group access to the summary file, then it's up to you. I understand the concern around the version number and correlating that with known exploits, but the version number is not a secret. It's literally one command away:
$ cat /opt/puppetlabs/puppet/VERSION |
7.6.1
|
and there are about 6 other ways to get the same information. Also know that this feature wasn't "implemented without a second thought." We actually did put a lot of thought into this, but sometimes oversights happen, and we welcome feedback. |
