HomeClusterLabs Projects

Feature: lrmd: Support CIB secrets - allow storing parameters in local files…

Description

Feature: lrmd: Support CIB secrets - allow storing parameters in local files (lf#2415, cl#5121, bnc#792140)

Sensitive information contained in the CIB can be moved to local files.
The CIB values are replaced by a magic string "lrm://" to signal lrmd
that it should lookup the content elsewhere.

An MD5 hash is stored in local file, by appending ".sign" extension.
lrmd checks if the hash matches the value in local files. If there is a
mismatch, the operation fails. stop operations are exceptions and they
proceed regardless (for stonith resources stop happens in stonithd and
for and for other resource it is very probable that passwords don't
influence stop).

Local files are stored in:
/var/lib/pacemaker/lrm/secrets/<rsc>/<param>

Reading from the legacy location is still possible for compatibility:
/var/lib/heartbeat/lrm/secrets/<rsc>/<param>

and files contain just a value, there's not format. The values may not
span multiple lines and whitespace at the right is stripped.

cibsecret is a program which handles user interface. It is not necessary
to use any other tools to manage the local files storage. Users don't
need to know about how and where the files are stored.

Details

Provenance
Dejan Muhamedagic <dejan@hello-penguin.com>Authored on Mar 6 2013, 12:40 AM
Andrew Beekhof <andrew@beekhof.net>Committed on Mar 6 2013, 3:29 PM
Parents
rP54723d4c9415: Fix: cts: Repair the local-init option now that report_common is generated
Branches
Unknown
Tags
Unknown

Event Timeline