Using best practices and security guidelines

Use these recommended security best practices and guidelines when deploying Automation Config and Salt in your environment.

Salt security

Consult these guides to ensure your environment is following best practices when implementing Salt in your infrastructure:

• Salt Best Practices
• Salt Hardening Guide

Automatic logout if inactive

You can set automatic logout as low as 1 minute, and up to 60 minutes. This is set to 30 minutes by default. For more on modifying this and other preferences, see Automation Config Terminology.

Permissions

Make sure to limit access to the following tasks. For more on defining permissions, see How do I define user roles.

Job create and edit

Limit user access to creating and editing jobs. These privileges enable a user to run any command in the system. Together with target create and edit permission, they enable a user to run any command on any minion.

Target create and edit

Limit user access to creating and editing targets. These privileges, along with Job create and edit permission, enable a user to run available jobs on any minion in the system.

Role create and edit

Limit user access to creating and editing roles. These privileges enable a user to assign themselves any privilege in the system.

Encrypted credentials

API (RaaS) Access Credentials

Connect Salt masters to the API (RaaS) through public key authentication (default), rather than through username authentication.

Database credentials

Store database credentials for both PostgreSQL and Redis in an encrypted file, rather than in plain text.

For more on credential storage, see Securing credentials in your configuration.