Hide Forgot
copied from AC: https://www.aeolusproject.org/redmine/issues/2660 This is used to sign session cookies. If all Conductor installations have the same key, it allows an attacker to modify or craft session cookies and then sign them so that the server will trust them. FWIW, I sent a patch to solve this, but it's sparked some further discussion on the right way to tackle this: https://fedorahosted.org/pipermail/aeolus-devel/2011-October/006010.html note there is a patch mentioned in above thread: https://fedorahosted.org/pipermail/aeolus-devel/2011-October/006011.html
I am not big fan of running rake task in the RPM post section. First of all its slow, second it can fail if any of our ruby dependencies does not match version. So I am adding this: sed -i "s/^Src::Application.config.secret_token = '.*'/Src::Application.config.secret_token = '$(</dev/urandom tr -dc A-Za-z0-9 | head -c128)'/" config/initializers/secret_token.rb It also generates BASE64-like string instead of simple hexa string. This is more secure.
1) I can confirm the string does not have to be hexa. It works with any (base64 etc) encoded string. 2) Rake use Bundler and we were facing many issues with incorrect dependencies (discussed on the ruby sig list). I tend not to use Bundler-based things in the RPM postun sections, because even when deps would be incorrect, I would like to have the RPM to be properly installed. Therefore we generate the same using tr and sed tools. http://git.fedorahosted.org/git/?p=katello.git;a=commitdiff;h=738bf1479390ba3d2df88ba24d43b9fbd118b160 It's also much faster. 3) Since the secret_token file is distributed, MD5 RPM validation fails. I don't think this is an issue. $ rpm -qV katello-common 5..T..... /usr/share/katello/config/initializers/secret_token.rb 738bf14 766939 - security_token.rb should be regenerated on each install
QA Verified that this is getting regenerated.