Puppet Master attempts to resolve agent hostname

newl in the #puppet channel suggested modifying ssl_verify_client to be 'optional', rather than 'on'. I've done this and everything's peachy now.

I had myself convinced that this was a Bad Thing to do, but after newl's suggestion I couldn't recall why. If anyone does believe this to be a less than ideal configuration setting, do let me know.

The documentation for the Puppet File Server should be able to cover most of what you are asking. In particular see the security section.

First a note. If you have autosign enabled, then pretty much any security offered is moot. You should verify each certificate. Since security settings you configure will be based on the hostname/certname or a regex match them, having autosign enabled would potentially mean that any un-trusted system could simple request a cert for a name that matched a pattern that had access to secret files.

By default anything in the special plugins and modules fileserver mounts are avialable to any client. But this can be controlled to a certain extent through the configuration.

You can also setup custom 'mounts' that point to specific locations. An example is provided in the documentation about how to create a [private] mount for distributing private SSH keys. The host name is used as part of the mount path, so a given host can only see files that belong to it.