[PATCH configure] BZ #850571 - replace insecure postgres initdb w/ standard secure approach
Mo Morsi
mmorsi at redhat.com
Mon Aug 27 15:29:05 UTC 2012
On 08/24/2012 05:11 PM, John Eckersberg wrote:
> Mo Morsi <mmorsi at redhat.com> writes:
>> + exec{ "pgauthuser":
>> + command => "/usr/bin/sed -i s/ident/md5/ /var/lib/pgsql/data/pg_hba.conf",
> Did you mean s/trust/ident/ here?
No. This patch changes the postgres init to utilize 'postgres-setup'
instead of 'initdb'
postgrep-setup will configure the hba to use ident authentication by
default (eg systems users) whereas we want to use md5 (lookup users /
passwords in the user db)
>
>> + require => Exec["pginitdb"],
>> + notify => Service["postgresql"]
>> + }
> This exec ends up running on each invocation of configure, which means
> the postgres service gets notified each run (and restarted). I'm seeing
> intermittent failures on various things later on in the configure run
> (mostly temp-admin user stuff) like:
>
> err: /Stage[main]/Aeolus::Profiles::Common/Aeolus::Conductor::Login[temporary-administrative-user-4107fa646e268357fba1d0ef4d075c8c491a6179f9beffe7]/Web_request[temporary-administrative-user-4107fa646e268357fba1d0ef4d075c8c491a6179f9beffe7-conductor-login]/post: change from to https://localhost/conductor/user_session failed: An exception was raised when invoking web request: Invalid HTTP Return Code: 500,
> was expecting one of 200
>
> with the matching rails exception:
>
> ActiveRecord::StatementInvalid (PGError: no connection to the server
> : SELECT "sessions".* FROM "sessions" WHERE "sessions"."session_id" = '9ea0c1c3080158cee1f7ebf6bd0f7749' LIMIT 1):
>
> So it looks like the postgres init script doesn't block for a complete
> reload, and the server is restarting somewhere in the middle of the
> configure run while we are trying to use it.
>
> We can get around this by adding to the pgauthuser exec:
>
> onlyif => "/bin/grep -q trust /var/lib/pgsql/data/pg_hba.conf"
>
> This was all testing on a previously-configured host; I'm going to
> reprovision and sanity check a clean host now.
I only tried this from a fresh install which prolly explains why I
missed this.
Seems like a good solution, though I believe we should be able to
trigger service restarts whenever postgres is restarted. I'll implement
the 'onlyif' and look into this as well and send out the updated
patchset shortly.
-Mo
More information about the aeolus-devel
mailing list