From 951e10755a95319e52523ca3c0bf67dcf7e83ba2 Mon Sep 17 00:00:00 2001 From: Jonathon Anderson Date: Thu, 20 Apr 2023 13:35:11 -0600 Subject: [PATCH] Additional documentation for warewulf.conf:warewulf.secure Closes #615 Signed-off-by: Jonathon Anderson --- docs/man/man5/warewulf.conf.5 | 11 ++++++----- userdocs/contents/configuration.rst | 12 +++++++----- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/docs/man/man5/warewulf.conf.5 b/docs/man/man5/warewulf.conf.5 index 8663c8c1..4a0fdd13 100644 --- a/docs/man/man5/warewulf.conf.5 +++ b/docs/man/man5/warewulf.conf.5 @@ -69,14 +69,15 @@ Default: 9983 \fBsecure\fP When true, this limits the Warewulf server to only respond to runtime -overlay requests originating from a privileged report port. This makes -it so that only the root user on a compute node can request the -runtime overlay. While generally there is nothing super "secure" in -these overlays, this adds the necessary protection that the users can -not obtain this information. +overlay requests originating from a privileged port. This prevents +non-root users from requesting the runtime overlay, which may contain +sensitive information. When true, wwclient uses TCP port 987. +Changing this option requires rebuilding node overlays and rebooting +compute nodes, to configure them to use a privileged port. + Default: true .IP diff --git a/userdocs/contents/configuration.rst b/userdocs/contents/configuration.rst index 7eb204a5..c3b01c8d 100644 --- a/userdocs/contents/configuration.rst +++ b/userdocs/contents/configuration.rst @@ -86,11 +86,13 @@ explained as follows: * ``warewulf:secure``: When ``true``, this limits the Warewulf server to only respond to runtime overlay requests originating from a - privileged report port. This makes it so that only the ``root`` user - on a compute node can request the runtime overlay. While generally - there is nothing super "secure" in these overlays, this adds the - necessary protection that the user's can not obtain this - information. + privileged port. This prevents non-root users from requesting the + runtime overlay, which may contain sensitive information. + + When ``true``, ``wwclient`` uses TCP port 987. + + Changing this option requires rebuilding node overlays and rebooting + compute nodes, to configure them to use a privileged port. * ``warewulf:update interval``: This defines the frequency (in seconds) with which the Warewulf client on the compute node fetches