{"action":"created","issue":{"url":"https://api.github.com/repos/CiscoCloud/mantl/issues/1165","repository_url":"https://api.github.com/repos/CiscoCloud/mantl","labels_url":"https://api.github.com/repos/CiscoCloud/mantl/issues/1165/labels{/name}","comments_url":"https://api.github.com/repos/CiscoCloud/mantl/issues/1165/comments","events_url":"https://api.github.com/repos/CiscoCloud/mantl/issues/1165/events","html_url":"https://github.com/CiscoCloud/mantl/pull/1165","id":136238730,"number":1165,"title":"Vault: Generation of One Time Passwords","user":{"login":"siddharthist","id":4294323,"avatar_url":"https://avatars.githubusercontent.com/u/4294323?v=3","gravatar_id":"","url":"https://api.github.com/users/siddharthist","html_url":"https://github.com/siddharthist","followers_url":"https://api.github.com/users/siddharthist/followers","following_url":"https://api.github.com/users/siddharthist/following{/other_user}","gists_url":"https://api.github.com/users/siddharthist/gists{/gist_id}","starred_url":"https://api.github.com/users/siddharthist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/siddharthist/subscriptions","organizations_url":"https://api.github.com/users/siddharthist/orgs","repos_url":"https://api.github.com/users/siddharthist/repos","events_url":"https://api.github.com/users/siddharthist/events{/privacy}","received_events_url":"https://api.github.com/users/siddharthist/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/CiscoCloud/mantl/labels/security","name":"security","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/CiscoCloud/mantl/milestones/9","html_url":"https://github.com/CiscoCloud/mantl/milestones/Feature%20Backlog","labels_url":"https://api.github.com/repos/CiscoCloud/mantl/milestones/9/labels","id":1396445,"number":9,"title":"Feature Backlog","description":"Features we'd like to attach to a release. ","creator":{"login":"stevendborrelli","id":414702,"avatar_url":"https://avatars.githubusercontent.com/u/414702?v=3","gravatar_id":"","url":"https://api.github.com/users/stevendborrelli","html_url":"https://github.com/stevendborrelli","followers_url":"https://api.github.com/users/stevendborrelli/followers","following_url":"https://api.github.com/users/stevendborrelli/following{/other_user}","gists_url":"https://api.github.com/users/stevendborrelli/gists{/gist_id}","starred_url":"https://api.github.com/users/stevendborrelli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevendborrelli/subscriptions","organizations_url":"https://api.github.com/users/stevendborrelli/orgs","repos_url":"https://api.github.com/users/stevendborrelli/repos","events_url":"https://api.github.com/users/stevendborrelli/events{/privacy}","received_events_url":"https://api.github.com/users/stevendborrelli/received_events","type":"User","site_admin":false},"open_issues":26,"closed_issues":37,"state":"open","created_at":"2015-11-05T21:10:50Z","updated_at":"2016-05-03T17:12:05Z","due_on":"2016-12-31T06:00:00Z","closed_at":null},"comments":2,"created_at":"2016-02-25T00:52:39Z","updated_at":"2016-05-05T02:16:48Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/CiscoCloud/mantl/pulls/1165","html_url":"https://github.com/CiscoCloud/mantl/pull/1165","diff_url":"https://github.com/CiscoCloud/mantl/pull/1165.diff","patch_url":"https://github.com/CiscoCloud/mantl/pull/1165.patch"},"body":"This adds a playbook called `generate-otps.yml` which can generate [Vault's One Time Passwords](https://www.vaultproject.io/docs/secrets/ssh/) for all hosts in the control group. It simplifies Vagrant's handling of secrets, but is currently impacted by a bug which causes all rsync commands to have the same arguments if they have the same path. \r\n\r\nA workaround might be to move `security.yml` and `ssl/` to a `secure/` directory in the project root, and we could a localhost block in our `playbooks/check-requirements.yml` to lock down permissions on this directory (this would have the added benifit of making our secrets more secure anyway).\r\n\r\nThis should be tested by creating a cluster the normal way, running `playbooks/generate-otps.yml`, and trying to log in via password authentication (use `-o PubkeyAuthentication=no` as an argument to `ssh`) twice with one of the generated OTPs. It should succeed the first time and fail the second. \r\n\r\nThis fixes #1107 "},"comment":{"url":"https://api.github.com/repos/CiscoCloud/mantl/issues/comments/217059351","html_url":"https://github.com/CiscoCloud/mantl/pull/1165#issuecomment-217059351","issue_url":"https://api.github.com/repos/CiscoCloud/mantl/issues/1165","id":217059351,"user":{"login":"siddharthist","id":4294323,"avatar_url":"https://avatars.githubusercontent.com/u/4294323?v=3","gravatar_id":"","url":"https://api.github.com/users/siddharthist","html_url":"https://github.com/siddharthist","followers_url":"https://api.github.com/users/siddharthist/followers","following_url":"https://api.github.com/users/siddharthist/following{/other_user}","gists_url":"https://api.github.com/users/siddharthist/gists{/gist_id}","starred_url":"https://api.github.com/users/siddharthist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/siddharthist/subscriptions","organizations_url":"https://api.github.com/users/siddharthist/orgs","repos_url":"https://api.github.com/users/siddharthist/repos","events_url":"https://api.github.com/users/siddharthist/events{/privacy}","received_events_url":"https://api.github.com/users/siddharthist/received_events","type":"User","site_admin":false},"created_at":"2016-05-05T02:16:48Z","updated_at":"2016-05-05T02:16:48Z","body":"Well, this has been rebased, the CI build passed, and the issue Brian raised about the loops has been fixed. I'm not sure if we want to consider the issue about IP address ambiguity a blocker. "}}