Hardening guides for different systems that can be managed by Puppet are easy to find, but not the guides for hardening Puppet itself.
The enterprise software configuration management (SCM) tool Puppet is valued by many SysAdmins and DevOps, e.g. at Google, for scalable, continuous and secure deployment of application server configuration files across large heterogeneous system landscapes and increasingly also as “end-to-end” compliance solution.
Disclaimer:
This blog post does not present anything new about Puppet security, but aims to
raise security awareness and summarize useful attack and audit techniques for an
internal black and whitebox infrastructure assessment of a Puppet Enterprise
landscape.
Most information in this post were collected during and based-on a time-limited
graybox Puppet landscape assessment (Puppet Enterprise version 6.4.0, on
RHEL7).
Hence, there is no claim for completeness and the post shall not be considered
as a fully fledged Puppet hardening guide.