Change ToDnssecRefresh.pl To Require Login

[Robert Butts <ro...@apache.org>]

Does anyone object to ToDnssecRefresh.pl being changed to take login
parameters?

I don't like changing things like this underneath people, but there's not a
good option here. The script is using an unauthenticated, non-API endpoint,
`/internal/api/1.2/cdns/dnsseckeys/refresh.json`, which will go away
shortly when Traffic Ops is changed to only server `/api` endpoints (which
is necessary for the current "Roles & Capabilities" system we're putting
in).

We also can't leave this endpoint unauthenticated, it's highly
CPU-intensive and could be used to DDOS Traffic Ops.

I have a Pull Request changing it to use a new API endpoint, and changing
the parameters it takes from `{"base_url": "https://to.invalid"}` to
`{"base_url":
"https://to.invalid", "user": "myUser", "pass": "myPass"}` (
https://github.com/apache/trafficcontrol/pull/2914).

It also writes an informative error, notifying of the need to add user+pass
params.

The PR also includes a Changelog update, indicating the need to update
script usage.

Hopefully those measures will minimize pain for anyone using the script who
doesn't notice the changelog.

Is everyone ok with that?

Thanks,

Re: Change ToDnssecRefresh.pl To Require Login

[Dave Neuman <ne...@apache.org>]

Seems fine to me.   This will only impact users that have DNSSEC enabled.

On Tue, Oct 23, 2018 at 3:32 PM Robert Butts <ro...@apache.org> wrote:

> Does anyone object to ToDnssecRefresh.pl being changed to take login
> parameters?
>
> I don't like changing things like this underneath people, but there's not
> a good option here. The script is using an unauthenticated, non-API
> endpoint, `/internal/api/1.2/cdns/dnsseckeys/refresh.json`, which will go
> away shortly when Traffic Ops is changed to only server `/api` endpoints
> (which is necessary for the current "Roles & Capabilities" system we're
> putting in).
>
> We also can't leave this endpoint unauthenticated, it's highly
> CPU-intensive and could be used to DDOS Traffic Ops.
>
> I have a Pull Request changing it to use a new API endpoint, and changing
> the parameters it takes from `{"base_url": "https://to.invalid"}` to `{"base_url":
> "https://to.invalid", "user": "myUser", "pass": "myPass"}` (
> https://github.com/apache/trafficcontrol/pull/2914).
>
> It also writes an informative error, notifying of the need to add
> user+pass params.
>
> The PR also includes a Changelog update, indicating the need to update
> script usage.
>
> Hopefully those measures will minimize pain for anyone using the script
> who doesn't notice the changelog.
>
> Is everyone ok with that?
>
> Thanks,
>
>