Puppet master (3.6.2) error on signing puppet client (2.7.25)

The documentation for the Puppet File Server should be able to cover most of what you are asking. In particular see the security section.

First a note. If you have autosign enabled, then pretty much any security offered is moot. You should verify each certificate. Since security settings you configure will be based on the hostname/certname or a regex match them, having autosign enabled would potentially mean that any un-trusted system could simple request a cert for a name that matched a pattern that had access to secret files.

By default anything in the special plugins and modules fileserver mounts are avialable to any client. But this can be controlled to a certain extent through the configuration.

You can also setup custom 'mounts' that point to specific locations. An example is provided in the documentation about how to create a [private] mount for distributing private SSH keys. The host name is used as part of the mount path, so a given host can only see files that belong to it.

Run puppet master --debug --no-daemonize and if you come to see

Error: Could not run: Address already in use - bind(2)

It probably means that the puppet master is already running. Try checking the output of

netstat -anpl | grep 8140

if you see a line referencing port 8140 with LISTEN, then that is probably your issue. (The puppet master process listens on port 8140 for incoming connections from clients by default.)

If you've followed the default setup for Ubuntu, apache will have started, listening on port 8140.

sudo service apache2 stop

then carry on with the config.