...
Introduction
- An Agent makes use of two configuration files:
- the general configuration file
agent.conf
is available from the following locations - the security configuration file
private.conf
is available from the following locations
- The configuration format makes use of Typesafe Config, see JS7 - Configuration Format
- Restart the Agent instance to apply changes to any configuration file.
Default Configuration
General Configuration
...
File: agent.conf
Enable HTTP Communication
By default the Agent configuration ships with HTTP communication enabled. It is recommended to create public/private keys and certificates for secure HTTPS communication and to disable HTTP Communication.
Code Block |
---|
language | text |
---|
title | Default configuration: enable HTTP communication |
---|
linenumbers | true |
---|
|
# Allow http connections without authentication
js7.web.server.auth.public = true
|
Security Configuration File: private.conf
Assign Directory for Trusted Certificates used to verify Signed Workflow Signatures
The Agent requires X.509 certificates and/or PGP public keys to be in place that are used to verify the signatures of signed workflows. Unsigned workflows are not accepted by an Agent, therefore a minimum of one X.509 certificate file or PGP public key file has to be present with the directories that are specified with the following configuration item:Default Location: /var/sos-berlin.com/js7/agent/var/config/agent.conf
Code Block |
---|
language | text |
---|
title | General Default configuration file example: agent.conf |
---|
linenumbers | true |
---|
collapse | true |
---|
|
# GeneralSecurity configuration
js7 {
webconfiguration {
server# {
Locations of certificates and public keys used for auth {signature verification
# Allow http connections without authenticationtrusted-signature-keys {
public = truePGP=${js7.config-directory}"/private/trusted-pgp-keys"
X509=${js7.config-directory}"/private/trusted-x509-keys"
}
}
}
|
js7.web.server: Authentication Settings
...
- This setting specifies public access to an Agent should insecure incoming HTTP connections be used. If used with a value
true
then no authentication applies. - Default:
false
...
Enable Script Execution from Signed Workflows
The default Agent configuration includes to allow job scripts to be executed. Alternatively scripts can be restricted to be executed from a predefined directory only.
Code Block |
---|
language | text |
---|
title | Default configuration: enable script execution from signed workflows |
---|
linenumbers | true |
---|
|
# Allow http connections without authentication
js7.job.execution.signed-script-injection-allowed = yes
|
Secure Configuration
File: private.conf
Default Location: /var/sos-berlin.com/js7/agent/var/config/private/private.conf
Code Block |
---|
language | text |
---|
title | Security configuration file example: private.conf |
---|
linenumbers | true |
---|
collapse | true |
---|
|
# Security configuration
js7 {
auth {
# User accounts for https connections
users {
# Controller account for connections by primary/secondary Controller instance
Controller {
distinguished-names=[
"DNQ=SOS CA, CN=controller-2-0-primary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE",
"DNQ=SOS CA, CN=controller-2-0-secondary, OU=IT, O=SOS, L=Berlin, ST=Berlin, C=DE"
]
}
}
}
configuration {
# Locations of certificates and public keys used for signature verification
trusted-signature-keys {
PGP=${js7.config-directory}"/private/trusted-pgp-keys"
X509=${js7.config-directory}"/private/trusted-x509-keys"
}
}
job {
# Enable script execution from signed workflows
execution {
signed-script-injection-allowed = yes
}
}
web {
# Locations of keystore and truststore files for HTTPS connections
https {
keystore {
# Default: ${js7.config-directory}"/private/https-keystore.p12"
file=${js7.config-directory}"/private/https-keystore.p12"
key-password=jobscheduler
store-password=jobscheduler
}
truststores=[
{
# Default: ${js7.config-directory}"/private/https-truststore.p12"
file=${js7.config-directory}"/private/https-truststore.p12"
store-password=jobscheduler
}
]
}
}
}
|
Configuration Items
General Configuration File: agent.conf
js7.web.server: Authentication Settings
js7 | web | server |
|
|
|
---|
|
|
| auth | public | <true>|<false> |
- This setting specifies public access to an Agent should insecure incoming HTTP connections be used. If used with a value
true
then no authentication applies. - Default:
false
Security Configuration File: private.conf
js7.job.execution: Script Execution Permissions
js7 | job | execution |
|
|
---|
|
|
| signed-script-injection-allowed | <yes>|<no> |
- By default the Agent prevents any commands and scripts to be executed except for scripts located in specific directories. This setting allows to execute any commands and scripts provided that the workflow is signed and the signature is verified for.
js7.auth.users: HTTPS Authentication and Authorization
js7 | auth | users |
|
|
|
---|
|
|
| Controller |
|
|
|
|
|
| distinguished-names | <distinguished-name>[,<distinguished-name] |
- When using HTTPS certificates or public keys for incoming connections, see below, then an additional authentication mechanism applies: the client of the incoming connection, i.e. a Controller, is required to provide a Client Authentication Certificate. This includes that two certificates are in place for a secure HTTPS connection: the Agent's Server Authentication Certificate and the Controller's Client Authentication Certificate.
- The fact that a given certificate is used for Server Authentication and/or Client Authentication is specified with the key usage when creating and signing the certificate.
- The distinguished name that is specified with the Agent's configuration has to match the Client Authentication Certificate's subject attribute of a Controller. This attribute specifies the hostname and additional information that is created when the certificate or public key is generated.
Controller
- Settings in this section are used for incoming HTTPS connections from Controller instances.
distinguished-names
: - Specifies the distinguished name as given with the subject of the Client Authentication Certificate for incoming HTTPS connections from a Controller.
- Any number of distinguished names can be specified allowing a number of incoming HTTPS connections from different Controllers.
js7.configuration: Trusted Signature Keys
js7 | configuration |
|
|
|
---|
|
| trusted-signature-keys |
|
|
|
|
| PGP | <directory> |
|
|
| X509 | <directory> |
- For any deployed objects such as workflows the Agent expects a signature. Such signatures are created with a private key and are verified by the Agent based on the available certificates.
- When deploying objects with JOC Cockpit
- for a Low Security Level JOC Cockpit creates the signature from a single private key that is used for any JOC Cockpit user accounts allowed to deploy objects.
- for a Medium Security Level JOC Cockpit creates the signature from the private key of the JOC Cockpit user account that deploy objects.
- for a High Security Level the user creates the signature outside of JOC Cockpit and uploads the signed objects.
- The Agent supports PGP public keys and X509 certificates. This setting expects a directory respectively that holds a number of public key files or certificate files.
trusted-signature-keys
PGP
: specifies the directory from which PGP public keys are used to verify the signature of deployed objects.X509
: specifies the directory from which X509 certificates are used to verify the signature of deployed objects.
js7.job.execution: Script Execution Permissions
...
- By default the Agent prevents any commands and scripts to be executed except for scripts located in specific directories. This setting allows to execute any commands and scripts provided that the workflow is signed and the signature is verified for
js7.web.https: HTTPS Certificates
js7 | web | https |
|
|
|
---|
|
|
| keystore |
|
|
|
|
|
| file | <path> |
|
|
|
| key-password | <text> |
|
|
|
| store-password | <text> |
|
|
| truststores |
|
|
|
|
|
| file | <path> |
|
|
|
| store-password | <text> |
...