{"action":"created","issue":{"url":"https://api.github.com/repos/saltstack/salt/issues/31863","repository_url":"https://api.github.com/repos/saltstack/salt","labels_url":"https://api.github.com/repos/saltstack/salt/issues/31863/labels{/name}","comments_url":"https://api.github.com/repos/saltstack/salt/issues/31863/comments","events_url":"https://api.github.com/repos/saltstack/salt/issues/31863/events","html_url":"https://github.com/saltstack/salt/issues/31863","id":140578922,"number":31863,"title":"How to securely copy file from one minion to another?","user":{"login":"rhansen","id":1612291,"avatar_url":"https://avatars.githubusercontent.com/u/1612291?v=3","gravatar_id":"","url":"https://api.github.com/users/rhansen","html_url":"https://github.com/rhansen","followers_url":"https://api.github.com/users/rhansen/followers","following_url":"https://api.github.com/users/rhansen/following{/other_user}","gists_url":"https://api.github.com/users/rhansen/gists{/gist_id}","starred_url":"https://api.github.com/users/rhansen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhansen/subscriptions","organizations_url":"https://api.github.com/users/rhansen/orgs","repos_url":"https://api.github.com/users/rhansen/repos","events_url":"https://api.github.com/users/rhansen/events{/privacy}","received_events_url":"https://api.github.com/users/rhansen/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/saltstack/salt/labels/Question","name":"Question","color":"942192"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/saltstack/salt/milestones/37","html_url":"https://github.com/saltstack/salt/milestones/Blocked","labels_url":"https://api.github.com/repos/saltstack/salt/milestones/37/labels","id":343741,"number":37,"title":"Blocked","description":"Issues which are blocked in some way, whether they need further discussion, clarification, justification, or are blocked for some other reason.","creator":{"login":"basepi","id":702318,"avatar_url":"https://avatars.githubusercontent.com/u/702318?v=3","gravatar_id":"","url":"https://api.github.com/users/basepi","html_url":"https://github.com/basepi","followers_url":"https://api.github.com/users/basepi/followers","following_url":"https://api.github.com/users/basepi/following{/other_user}","gists_url":"https://api.github.com/users/basepi/gists{/gist_id}","starred_url":"https://api.github.com/users/basepi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basepi/subscriptions","organizations_url":"https://api.github.com/users/basepi/orgs","repos_url":"https://api.github.com/users/basepi/repos","events_url":"https://api.github.com/users/basepi/events{/privacy}","received_events_url":"https://api.github.com/users/basepi/received_events","type":"User","site_admin":false},"open_issues":383,"closed_issues":772,"state":"open","created_at":"2013-05-28T22:24:12Z","updated_at":"2016-03-15T20:56:34Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2016-03-14T05:22:35Z","updated_at":"2016-03-16T07:43:34Z","closed_at":null,"body":"How do I use Salt to securely copy a sensitive file (a cryptographic key) from one specific minion to another specific minion?  I don't want any other minion to be able to read the file.\r\n\r\n### Salt Mine?\r\n\r\nThe [Salt Mine](https://docs.saltstack.com/en/latest/topics/mine/) seems to be a logical place to start, but the documentation says:\r\n\r\n> The Salt Mine is used to collect arbitrary data from Minions and store it on the Master. This data is then made available to all Minions via the [`salt.modules.mine`](https://docs.saltstack.com/en/latest/ref/modules/all/salt.modules.mine.html#module-salt.modules.mine) module.\r\n\r\nI don't want the data to be made available to all minions, just one.  In addition I don't need the periodic refresh—I only need the file to be read whenever I run `state.highstate` for the destination minion.  And I don't know whether Salt Mine uses a secure transport.\r\n\r\n### `cp.push`?\r\n\r\nSalt's [`cp.push`](https://docs.saltstack.com/en/latest/ref/modules/all/salt.modules.cp.html#salt.modules.cp.push) function seems like a good way to get the file to the master, except:\r\n\r\n  * it uses the `salt.transport.Channel.send()` method which is [not guaranteed to be confidential](https://docs.saltstack.com/en/develop/topics/transports/index.html#req-channel)\r\n  * the master gives the files pushed by `cp.push` global read permissions in the master's file system\r\n  * once the file is on the master, it's not obvious how to get it to the destination minion\r\n\r\n### Custom External Pillar?\r\n\r\nI could write a [custom external pillar](https://docs.saltstack.com/en/latest/topics/development/external_pillars.html) that somehow reads the file from the source minion and then makes the file's contents available via a pillar to a second minion.  How would I get the master to securely fetch the file's contents from the source minion?"},"comment":{"url":"https://api.github.com/repos/saltstack/salt/issues/comments/197199095","html_url":"https://github.com/saltstack/salt/issues/31863#issuecomment-197199095","issue_url":"https://api.github.com/repos/saltstack/salt/issues/31863","id":197199095,"user":{"login":"jfindlay","id":702905,"avatar_url":"https://avatars.githubusercontent.com/u/702905?v=3","gravatar_id":"","url":"https://api.github.com/users/jfindlay","html_url":"https://github.com/jfindlay","followers_url":"https://api.github.com/users/jfindlay/followers","following_url":"https://api.github.com/users/jfindlay/following{/other_user}","gists_url":"https://api.github.com/users/jfindlay/gists{/gist_id}","starred_url":"https://api.github.com/users/jfindlay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfindlay/subscriptions","organizations_url":"https://api.github.com/users/jfindlay/orgs","repos_url":"https://api.github.com/users/jfindlay/repos","events_url":"https://api.github.com/users/jfindlay/events{/privacy}","received_events_url":"https://api.github.com/users/jfindlay/received_events","type":"User","site_admin":false},"created_at":"2016-03-16T07:43:34Z","updated_at":"2016-03-16T07:43:34Z","body":"@rhansen, your assessment seems valid to me.  I am not very familiar with that part of the code base.  @cachedout may have more/better advice."}}