Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RPM is not signed #32

Open
mrwacky42 opened this issue Mar 9, 2021 · 3 comments · May be fixed by #34
Open

RPM is not signed #32

mrwacky42 opened this issue Mar 9, 2021 · 3 comments · May be fixed by #34

Comments

@mrwacky42
Copy link

mrwacky42 commented Mar 9, 2021

This ansible role fails on Amazon Linux 2 instances due to an unsigned package.
Amazon Linux 2 instances have gpgcheck=1 configured by default.

As implemented, this role does not work on Amazon Linux 2, or any system with gpgcheck=1 enabled.
Workaround: switch from package to yum for RedHat and explicitly set disable_gpg_check: true

It seems that a security product should expect to be installed on a securely configured instance.
Given the recent debacle with Solarwinds, it is somewhat scary to install vendors unsigned packages.

@deekayen
Copy link

deekayen commented May 5, 2022

Since it's been over a year, I forked this project and published an alternative to Galaxy. https://github.com/deekayen/al-agents-ansible-playbooks has a kludge, some updates, and Molecule testing until I can get Alert Logic to publish the GPG key so we can do a proper key import and/or validation task.

deekayen added a commit to deekayen/al-agents-ansible-playbooks that referenced this issue May 16, 2022
Import Alert Logic GPG key, validate the fingerprint, verify RPM.
@dsix-work
Copy link

Something like this would probably be sufficient for RHEL 8/9:

In tasks/install_agent.yml:

    - name: Import Alert Logic Atlas GPG key.
      ansible.builtin.rpm_key:
        key: "{{ al_agent_gpg_key }}"
        fingerprint: "{{ al_agent_gpg_fingerprint }}"
        state: present
      when:
        - ansible_os_family == "RedHat"

In vars/RedHat.yml:

al_agent_gpg_key: "{{ al_agent_base_url }}/software/al-agent-pkg-key.asc"
al_agent_gpg_fingerprint: '9a2a3e9a817127b121b2b2fb00802f0e0186cc36'

@jearly
Copy link
Contributor

jearly commented May 31, 2023

Public contributions are welcome! Anyone can submit a Pull Request for features and further OS support. We will review them and publish them once approved. Please follow the guidelines in the Readme and we will happily review and test them on our end. https://github.com/alertlogic/al-agents-ansible-playbooks#contributing

@dsix-work dsix-work linked a pull request Jun 2, 2023 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
4 participants