puppet 2.6.18 → 2.7.1

data/man/man8/puppet-cert.8

@@ -0,0 +1,97 @@
+.\" generated with Ronn/v0.7.3
+.\" http://github.com/rtomayko/ronn/tree/0.7.3
+.
+.TH "PUPPET\-CERT" "8" "June 2011" "Puppet Labs, LLC" "Puppet manual"
+.
+.SH "NAME"
+\fBpuppet\-cert\fR \- Manage certificates and requests
+.
+.SH "SYNOPSIS"
+Standalone certificate authority\. Capable of generating certificates, but mostly used for signing certificate requests from puppet clients\.
+.
+.SH "USAGE"
+puppet cert \fIaction\fR [\-h|\-\-help] [\-V|\-\-version] [\-d|\-\-debug] [\-v|\-\-verbose] [\-\-digest \fIdigest\fR] [\fIhost\fR]
+.
+.SH "DESCRIPTION"
+Because the puppet master service defaults to not signing client certificate requests, this script is available for signing outstanding requests\. It can be used to list outstanding requests and then either sign them individually or sign all of them\.
+.
+.SH "ACTIONS"
+Every action except \'list\' and \'generate\' requires a hostname to act on, unless the \'\-\-all\' option is set\.
+.
+.TP
+clean
+Revoke a host\'s certificate (if applicable) and remove all files related to that host from puppet cert\'s storage\. This is useful when rebuilding hosts, since new certificate signing requests will only be honored if puppet cert does not have a copy of a signed certificate for that host\. If \'\-\-all\' is specified then all host certificates, both signed and unsigned, will be removed\.
+.
+.TP
+fingerprint
+Print the DIGEST (defaults to md5) fingerprint of a host\'s certificate\.
+.
+.TP
+generate
+Generate a certificate for a named client\. A certificate/keypair will be generated for each client named on the command line\.
+.
+.TP
+list
+List outstanding certificate requests\. If \'\-\-all\' is specified, signed certificates are also listed, prefixed by \'+\', and revoked or invalid certificates are prefixed by \'\-\' (the verification outcome is printed in parenthesis)\.
+.
+.TP
+print
+Print the full\-text version of a host\'s certificate\.
+.
+.TP
+revoke
+Revoke the certificate of a client\. The certificate can be specified either by its serial number (given as a decimal number or a hexadecimal number prefixed by \'0x\') or by its hostname\. The certificate is revoked by adding it to the Certificate Revocation List given by the \'cacrl\' configuration option\. Note that the puppet master needs to be restarted after revoking certificates\.
+.
+.TP
+sign
+Sign an outstanding certificate request\.
+.
+.TP
+verify
+Verify the named certificate against the local CA certificate\.
+.
+.SH "OPTIONS"
+Note that any configuration parameter that\'s valid in the configuration file is also a valid long argument\. For example, \'ssldir\' is a valid configuration parameter, so you can specify \'\-\-ssldir \fIdirectory\fR\' as an argument\.
+.
+.P
+See the configuration file documentation at http://docs\.puppetlabs\.com/references/stable/configuration\.html for the full list of acceptable parameters\. A commented list of all configuration options can also be generated by running puppet cert with \'\-\-genconfig\'\.
+.
+.TP
+\-\-all
+Operate on all items\. Currently only makes sense with the \'sign\', \'clean\', \'list\', and \'fingerprint\' actions\.
+.
+.TP
+\-\-digest
+Set the digest for fingerprinting (defaults to md5)\. Valid values depends on your openssl and openssl ruby extension version, but should contain at least md5, sha1, md2, sha256\.
+.
+.TP
+\-\-debug
+Enable full debugging\.
+.
+.TP
+\-\-help
+Print this help message
+.
+.TP
+\-\-verbose
+Enable verbosity\.
+.
+.TP
+\-\-version
+Print the puppet version number and exit\.
+.
+.SH "EXAMPLE"
+.
+.nf
+
+$ puppet cert list
+culain\.madstop\.com
+$ puppet cert sign culain\.madstop\.com
+.
+.fi
+.
+.SH "AUTHOR"
+Luke Kanies
+.
+.SH "COPYRIGHT"
+Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2\.0 License

data/man/man8/puppet-certificate.8

@@ -0,0 +1,229 @@
+.\" generated with Ronn/v0.7.3
+.\" http://github.com/rtomayko/ronn/tree/0.7.3
+.
+.TH "PUPPET\-CERTIFICATE" "8" "June 2011" "Puppet Labs, LLC" "Puppet manual"
+.
+.SH "NAME"
+\fBpuppet\-certificate\fR \- Provide access to the CA for certificate management\.
+.
+.SH "SYNOPSIS"
+puppet certificate \fIaction\fR [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION]
+.
+.SH "DESCRIPTION"
+This subcommand interacts with a local or remote Puppet certificate authority\. Currently, its behavior is not a full superset of \fBpuppet cert\fR; specifically, it is unable to mimic puppet cert\'s "clean" option, and its "generate" action submits a CSR rather than creating a signed certificate\.
+.
+.SH "OPTIONS"
+Note that any configuration parameter that\'s valid in the configuration file is also a valid long argument, although it may or may not be relevant to the present action\. For example, \fBserver\fR is a valid configuration parameter, so you can specify \fB\-\-server <servername>\fR as an argument\.
+.
+.P
+See the configuration file documentation at \fIhttp://docs\.puppetlabs\.com/references/stable/configuration\.html\fR for the full list of acceptable parameters\. A commented list of all configuration options can also be generated by running puppet with \fB\-\-genconfig\fR\.
+.
+.TP
+\-\-mode MODE
+The run mode to use for the current action\. Valid modes are \fBuser\fR, \fBagent\fR, and \fBmaster\fR\.
+.
+.TP
+\-\-render\-as FORMAT
+The format in which to render output\. The most common formats are \fBjson\fR, \fBs\fR (string), \fByaml\fR, and \fBconsole\fR, but other options such as \fBdot\fR are sometimes available\.
+.
+.TP
+\-\-verbose
+Whether to log verbosely\.
+.
+.TP
+\-\-debug
+Whether to log debug information\.
+.
+.TP
+\-\-ca\-location LOCATION
+Whether to act on the local certificate authority or one provided by a remote puppet master\. Allowed values are \'local\' and \'remote\.\'
+.
+.IP
+This option is required\.
+.
+.TP
+\-\-terminus TERMINUS
+Indirector faces expose indirected subsystems of Puppet\. These subsystems are each able to retrieve and alter a specific type of data (with the familiar actions of \fBfind\fR, \fBsearch\fR, \fBsave\fR, and \fBdestroy\fR) from an arbitrary number of pluggable backends\. In Puppet parlance, these backends are called terminuses\.
+.
+.IP
+Almost all indirected subsystems have a \fBrest\fR terminus that interacts with the puppet master\'s data\. Most of them have additional terminuses for various local data models, which are in turn used by the indirected subsystem on the puppet master whenever it receives a remote request\.
+.
+.IP
+The terminus for an action is often determined by context, but occasionally needs to be set explicitly\. See the "Notes" section of this face\'s manpage for more details\.
+.
+.SH "ACTIONS"
+.
+.TP
+\fBdestroy\fR \- Delete a certificate\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate destroy [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION] \fIhost\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Deletes a certificate\. This action currently only works on the local CA\.
+.
+.IP
+\fBRETURNS\fR
+.
+.IP
+Nothing\.
+.
+.TP
+\fBfind\fR \- Retrieve a certificate\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate find [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION] \fIhost\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Retrieve a certificate\.
+.
+.IP
+\fBRETURNS\fR
+.
+.IP
+An x509 SSL certificate\. You will usually want to render this as a string (\-\-render\-as s)\.
+.
+.IP
+Note that this action has a side effect of caching a copy of the certificate in Puppet\'s \fBssldir\fR\.
+.
+.TP
+\fBgenerate\fR \- Generate a new certificate signing request\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate generate [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION] \fIhost\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Generates and submits a certificate signing request (CSR) for the specified host\. This CSR will then have to be signed by a user with the proper authorization on the certificate authority\.
+.
+.IP
+Puppet agent usually handles CSR submission automatically\. This action is primarily useful for requesting certificates for individual users and external applications\.
+.
+.IP
+\fBRETURNS\fR
+.
+.IP
+Nothing\.
+.
+.TP
+\fBinfo\fR \- Print the default terminus class for this face\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate info [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION]
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Prints the default terminus class for this subcommand\. Note that different run modes may have different default termini; when in doubt, specify the run mode with the \'\-\-mode\' option\.
+.
+.TP
+\fBlist\fR \- List all certificate signing requests\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate list [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION]
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+List all certificate signing requests\.
+.
+.IP
+\fBRETURNS\fR
+.
+.IP
+An array of #inspect output from CSR objects\. This output is currently messy, but does contain the names of nodes requesting certificates\. This action returns #inspect strings even when used from the Ruby API\.
+.
+.TP
+\fBsave\fR \- Invalid for this subcommand\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate save [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION]
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Invalid for this subcommand\.
+.
+.TP
+\fBsearch\fR \- Invalid for this subcommand\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate search [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION] \fIquery\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Invalid for this subcommand\.
+.
+.TP
+\fBsign\fR \- Sign a certificate signing request for HOST\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate sign [\-\-terminus TERMINUS] [\-\-ca\-location LOCATION] \fIhost\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Sign a certificate signing request for HOST\.
+.
+.IP
+\fBRETURNS\fR
+.
+.IP
+A string that appears to be (but isn\'t) an x509 certificate\.
+.
+.SH "EXAMPLES"
+\fBgenerate\fR
+.
+.P
+Request a certificate for "somenode" from the site\'s CA:
+.
+.P
+$ puppet certificate generate somenode\.puppetlabs\.lan \-\-ca\-location remote
+.
+.P
+\fBsign\fR
+.
+.P
+Sign somenode\.puppetlabs\.lan\'s certificate:
+.
+.P
+$ puppet certificate sign somenode\.puppetlabs\.lan \-\-ca\-location remote
+.
+.SH "NOTES"
+This subcommand is an indirector face, which exposes \fBfind\fR, \fBsearch\fR, \fBsave\fR, and \fBdestroy\fR actions for an indirected subsystem of Puppet\. Valid termini for this face include:
+.
+.IP "\(bu" 4
+\fBca\fR
+.
+.IP "\(bu" 4
+\fBfile\fR
+.
+.IP "\(bu" 4
+\fBrest\fR
+.
+.IP "" 0
+.
+.SH "COPYRIGHT AND LICENSE"
+Copyright 2011 by Puppet Labs Apache 2 license; see COPYING

data/man/man8/puppet-certificate_request.8

@@ -0,0 +1,168 @@
+.\" generated with Ronn/v0.7.3
+.\" http://github.com/rtomayko/ronn/tree/0.7.3
+.
+.TH "PUPPET\-CERTIFICATE_REQUEST" "8" "June 2011" "Puppet Labs, LLC" "Puppet manual"
+.
+.SH "NAME"
+\fBpuppet\-certificate_request\fR \- Manage certificate requests\.
+.
+.SH "SYNOPSIS"
+puppet certificate_request \fIaction\fR [\-\-terminus TERMINUS]
+.
+.SH "DESCRIPTION"
+This subcommand retrieves and submits certificate signing requests (CSRs)\.
+.
+.SH "OPTIONS"
+Note that any configuration parameter that\'s valid in the configuration file is also a valid long argument, although it may or may not be relevant to the present action\. For example, \fBserver\fR is a valid configuration parameter, so you can specify \fB\-\-server <servername>\fR as an argument\.
+.
+.P
+See the configuration file documentation at \fIhttp://docs\.puppetlabs\.com/references/stable/configuration\.html\fR for the full list of acceptable parameters\. A commented list of all configuration options can also be generated by running puppet with \fB\-\-genconfig\fR\.
+.
+.TP
+\-\-mode MODE
+The run mode to use for the current action\. Valid modes are \fBuser\fR, \fBagent\fR, and \fBmaster\fR\.
+.
+.TP
+\-\-render\-as FORMAT
+The format in which to render output\. The most common formats are \fBjson\fR, \fBs\fR (string), \fByaml\fR, and \fBconsole\fR, but other options such as \fBdot\fR are sometimes available\.
+.
+.TP
+\-\-verbose
+Whether to log verbosely\.
+.
+.TP
+\-\-debug
+Whether to log debug information\.
+.
+.TP
+\-\-terminus TERMINUS
+Indirector faces expose indirected subsystems of Puppet\. These subsystems are each able to retrieve and alter a specific type of data (with the familiar actions of \fBfind\fR, \fBsearch\fR, \fBsave\fR, and \fBdestroy\fR) from an arbitrary number of pluggable backends\. In Puppet parlance, these backends are called terminuses\.
+.
+.IP
+Almost all indirected subsystems have a \fBrest\fR terminus that interacts with the puppet master\'s data\. Most of them have additional terminuses for various local data models, which are in turn used by the indirected subsystem on the puppet master whenever it receives a remote request\.
+.
+.IP
+The terminus for an action is often determined by context, but occasionally needs to be set explicitly\. See the "Notes" section of this face\'s manpage for more details\.
+.
+.SH "ACTIONS"
+.
+.TP
+\fBdestroy\fR \- Invalid for this subcommand\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate_request destroy [\-\-terminus TERMINUS] \fIkey\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Invalid for this subcommand\.
+.
+.TP
+\fBfind\fR \- Retrieve a single CSR\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate_request find [\-\-terminus TERMINUS] \fIhost\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Retrieve a single CSR\.
+.
+.IP
+\fBRETURNS\fR
+.
+.IP
+A single certificate request\. When used from the Ruby API, returns a Puppet::SSL::CertificateRequest object\.
+.
+.IP
+RENDERING ISSUES: In most cases, you will want to render this as a string (\'\-\-render\-as s\')\.
+.
+.TP
+\fBinfo\fR \- Print the default terminus class for this face\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate_request info [\-\-terminus TERMINUS]
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Prints the default terminus class for this subcommand\. Note that different run modes may have different default termini; when in doubt, specify the run mode with the \'\-\-mode\' option\.
+.
+.TP
+\fBsave\fR \- API only: submit a certificate signing request\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate_request save [\-\-terminus TERMINUS] \fIx509_CSR\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+API only: create or overwrite an object\. As the Faces framework does not currently accept data from STDIN, save actions cannot currently be invoked from the command line\.
+.
+.TP
+\fBsearch\fR \- Retrieve all outstanding CSRs\.
+\fBSYNOPSIS\fR
+.
+.IP
+puppet certificate_request search [\-\-terminus TERMINUS] \fIdummy_text\fR
+.
+.IP
+\fBDESCRIPTION\fR
+.
+.IP
+Retrieve all outstanding CSRs\.
+.
+.IP
+\fBRETURNS\fR
+.
+.IP
+A list of certificate requests; be sure to to render this as a string (\'\-\-render\-as s\')\. When used from the Ruby API, returns an array of Puppet::SSL::CertificateRequest objects\.
+.
+.IP
+\fBNOTES\fR
+.
+.IP
+Although this action always returns all CSRs, it requires a dummy search key; this is a known bug\.
+.
+.SH "EXAMPLES"
+\fBfind\fR
+.
+.P
+Retrieve a single CSR from the puppet master\'s CA:
+.
+.P
+$ puppet certificate_request find somenode\.puppetlabs\.lan \-\-terminus rest
+.
+.P
+\fBsearch\fR
+.
+.P
+Retrieve all CSRs from the local CA (similar to \'puppet cert list\'):
+.
+.P
+$ puppet certificate_request search x \-\-terminus ca
+.
+.SH "NOTES"
+This subcommand is an indirector face, which exposes \fBfind\fR, \fBsearch\fR, \fBsave\fR, and \fBdestroy\fR actions for an indirected subsystem of Puppet\. Valid termini for this face include:
+.
+.IP "\(bu" 4
+\fBca\fR
+.
+.IP "\(bu" 4
+\fBfile\fR
+.
+.IP "\(bu" 4
+\fBrest\fR
+.
+.IP "" 0
+.
+.SH "COPYRIGHT AND LICENSE"
+Copyright 2011 by Puppet Labs Apache 2 license; see COPYING