Table des matières
Additional Network Scripts: Network Key Renewal
VMoodle: Technical Guide
Context
The MNET network relies on a symmetric exchange of SSH keys in order to encode and decode the messages (xmlrpc) exchanged between tenants. These keys have a limited lifetime and can only be refreshed:
- by an explicit action of the administrator
- by the circulation of a user presenting a known old key.
However, a network of tenants able to exchange data through MNET calls, without user circulation, can see its key expire and block the data and service exchange capabilities, but also (for an expired key) block the key reconciliation capability.
It is possible to extend the lifetime of the keys through configuration, but the keys will always have a finite lifetime.
Action
This script:
- Resets its local key for a new validity period
- Distributes its key in “forced” mode to all the active MNET hosts it knows in its environment.
Syntax
\$sudo -u www-data /usr/bin/php local/vmoodle/cli/renew_mnetkeys.php --host=http://my.virtual.moodle.org
Options
- -b, –bindhost Tenant to connect. (see details below)
- -n, –newkey Renews the local key (startmnet) before the operation.
- -H, –host Runs the command on this vmoodle tenant
- -h, –help Displays help
- -d, –debug Enables debug mode
Additional notes
The "forced" mode
This mode relies on a set of patches provided by the local_vmoodle component. It makes it possible to slightly modify the rule for accepting the key exchange between Moodle peers.
In a standard Moodle, Moodle checks that the caller has a valid key in its key memory cache, which is an unacceptable precondition when the key is already expired.
In forced mode we accept re-registering a peer's key as soon as it is referenced in the local mnet environment.
Back to the technical guide - Back to the component index - Back to the plugins index - Back to the catalogue