Don't require ACLs in MIG Agent
jvehent opened this issue · comments
ACLs should be optional to allow simpler deployment to let any investigator with a configured pgp fingerprint to send actions.
In code terms, that means putting VerifyACL in mig-agent/acl.go behind a configuration flag.
Hello.
I'd love to jump into this project and this looks like a good point. If this is still desired, can you give me a quick overview/example of how configuration flags are handled in MIG? Even if it's just another file I'd like to see an example of a configuration flag in action.
@jboyer2012 the configuration flags for the agent you can find here:
These can be considered "defaults", and are compiled into the agent:
https://github.com/mozilla/mig/blob/master/mig-agent/configuration.go
Then, if a configuration file exists, the defaults are overridden using the configuration file in here:
https://github.com/mozilla/mig/blob/master/mig-agent/config.go
So what you'd probably want to do is add a new option, VERIFYACLS or something along those lines, which can be true or false, defaulting to true. If false, we wouldn't require an ACL configuration, just a valid signature, which we'd verify using the public key list in the agent.
The verification starts here:
https://github.com/mozilla/mig/blob/master/mig-agent/acl.go#L52
Then eventually ends up here:
https://github.com/mozilla/mig/blob/master/action.go#L362-L369
That code block does verification of signatures, with fingerprints eventually containing a list of all the valid key fingerprints used to sign the action, so I think we could add something after that to make sure fingerprints is not empty and if our configuration flag is set to not require ACL verification we just return.
For a simple example of how you might use a bool config flag in the agent, here's one: https://github.com/mozilla/mig/blob/master/mig-agent/agent.go#L443
@ameihm0912 Thanks for the great overview! Can this be easily tested with a standalone installation?
Yep, no problem implementing this with the standalone installation
One more question, is there a page with standards/guidelines for contributing?
Should all be at https://github.com/mozilla/mig/blob/master/CONTRIBUTING.md
Hi I need a little help. I feel like I have the configuration piece figured out. However, the configuration global object seems to be accessible only to code in the mig-agent folder. The action.go file is not within mig-agent and thus I cannot access the new VERIFYACLS global variable to make a decision. Sorry if this is a simple mistake but I'm new to Go so I ask for some patience.
@jboyer2012 ah yes I see; one possible option is you could add a new flag to VerifyACL (e.g., onlyVerifyKey bool), and based on the setting in the mig-agent set that to true or false when you call VerifyACL(), something along those lines
@ameihm0912 Thanks for the advice. I've implemented the changes. Before the pull request I wanted to make sure I'm on the right track. Can you take a quick look?
jboyer2012@0933504
Also, how would I test to make sure this works? Would it have to be manual or is there a way to automate this?
@jboyer2012 apologies for the delayed response
I had a quick pass and that looks pretty much exactly like what we'd want -- want to PR it and we can do a more detailed review?
In terms of automatically testing it, right now we would have to do it manually. We do have some basic travis tests that run, but at this time they don't really lend themselves well to testing certain agent configurations (the travis test just configures a single agent and verifies it responds to a query).
Maybe we could add some go test style unit tests to validate the behavior of the flag
My PR has been accepted. Can this issue be closed?
Indeed, thanks!