[PATCH] BZ #850571 - secure postgres access config - remove custom access config - use postgres-setup to generate secure config - switch ident (system user) auth to md5-passwd based accounts

Mo Morsi mmorsi at redhat.com
Mon Aug 27 17:57:56 UTC 2012


---
 recipes/aeolus/files/pg_hba-ssl.conf  |    7 -------
 recipes/aeolus/files/pg_hba.conf      |    4 ----
 recipes/aeolus/manifests/conductor.pp |   23 ++++++++---------------
 recipes/postgres/manifests/server.pp  |    4 +---
 recipes/postgres/manifests/user.pp    |   12 ++++++------
 5 files changed, 15 insertions(+), 35 deletions(-)
 delete mode 100644 recipes/aeolus/files/pg_hba-ssl.conf
 delete mode 100644 recipes/aeolus/files/pg_hba.conf

diff --git a/recipes/aeolus/files/pg_hba-ssl.conf b/recipes/aeolus/files/pg_hba-ssl.conf
deleted file mode 100644
index 722867b..0000000
--- a/recipes/aeolus/files/pg_hba-ssl.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# we are still leaving Unix-domain sockets open, if we want to disable
-# make sure to append "sslmode=require" and "-h localhost" to all psql
-# commands
-local all all trust
-hostssl all         all    127.0.0.1/32             md5
-hostssl all         all    ::1/128                  md5
-
diff --git a/recipes/aeolus/files/pg_hba.conf b/recipes/aeolus/files/pg_hba.conf
deleted file mode 100644
index ef3f6f5..0000000
--- a/recipes/aeolus/files/pg_hba.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-local all all trust
-host  all all 127.0.0.1 255.255.255.255 md5
-host  all all ::1/128 md5
-
diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp
index 30882c3..9fb8a66 100644
--- a/recipes/aeolus/manifests/conductor.pp
+++ b/recipes/aeolus/manifests/conductor.pp
@@ -96,37 +96,30 @@ class aeolus::conductor inherits aeolus {
                owner   => 'postgres',
                group   => 'postgres',
                notify  => Service['postgresql'] }
-      file { "/var/lib/pgsql/data/pg_hba.conf":
-               source  => "puppet:///modules/aeolus/pg_hba-ssl.conf",
-               require => Exec["pginitdb"],
-               owner   => 'postgres',
-               group   => 'postgres',
-               notify  => Service['postgresql']}
       file { "/var/lib/pgsql/data/postgresql.conf":
                source  => "puppet:///modules/aeolus/postgresql.conf",
                require => Exec["pginitdb"],
                owner   => 'postgres',
                group   => 'postgres',
                notify  => Service['postgresql']}
-    } else {
-      file { "/var/lib/pgsql/data/pg_hba.conf":
-               source => "puppet:///modules/aeolus/pg_hba.conf",
-               require => Exec["pginitdb"],
-               owner   => 'postgres',
-               group   => 'postgres',
-               notify  => Service['postgresql']}
+    }
+    exec{ "pgauthuser":
+      command     => "/usr/bin/sed -i s/ident/md5/ /var/lib/pgsql/data/pg_hba.conf",
+      onlyif      => '/bin/grep -q ident /var/lib/pgsql/data/pg_hba.conf',
+      require     => Exec["pginitdb"],
+      notify      => Service["postgresql"]
     }
     postgres::user{"aeolus":
                      password => "v23zj59an",
                      roles    => "CREATEDB",
-                     require  => [Service["postgresql"], File["/var/lib/pgsql/data/pg_hba.conf"]] }
+                     require  => Service["postgresql"] }
 
 
     # Create aeolus database
     aeolus::rails::create::db{"create_aeolus_database":
                 cwd        => "/usr/share/aeolus-conductor",
                 rails_env  => "production",
-                require    => [Postgres::User[aeolus], Package['aeolus-conductor']] }
+                require    => [Postgres::User[aeolus], Exec['pgauthuser'], Package['aeolus-conductor']] }
     aeolus::rails::migrate::db{"migrate_aeolus_database":
                 cwd             => "/usr/share/aeolus-conductor",
                 rails_env       => "production",
diff --git a/recipes/postgres/manifests/server.pp b/recipes/postgres/manifests/server.pp
index 09ea6d7..1bd4b28 100644
--- a/recipes/postgres/manifests/server.pp
+++ b/recipes/postgres/manifests/server.pp
@@ -24,9 +24,7 @@ class postgres::server inherits postgres {
     }
 
     exec { "pginitdb":
-        command         => "/usr/bin/initdb --pgdata='/var/lib/pgsql/data' -E UTF8",
-        user            => "postgres",
-        group           => "postgres",
+        command         => "/usr/bin/postgresql-setup initdb",
         creates         => "/var/lib/pgsql/data/PG_VERSION",
         require         => Package["postgresql-server"],
         notify          => Service["postgresql"],
diff --git a/recipes/postgres/manifests/user.pp b/recipes/postgres/manifests/user.pp
index a910a2e..e767e1d 100644
--- a/recipes/postgres/manifests/user.pp
+++ b/recipes/postgres/manifests/user.pp
@@ -2,13 +2,13 @@ define postgres::user($ensure='created', $password="", $roles=""){
   case $ensure {
     'created': {
       exec{"create_${name}_postgres_user":
-             unless  => "/usr/bin/test `psql postgres postgres -P tuples_only -c \"select count(*) from pg_user where usename='${name}';\"` = \"1\"",
-             command => "/usr/bin/psql postgres postgres -c \
-                         \"CREATE USER ${name} WITH PASSWORD '${password}' ${roles}\""}}
+             unless  => "/usr/bin/test `/usr/bin/su postgres -c \"psql postgres postgres -P tuples_only -c \\\"select count(*) from pg_user where usename='${name}';\\\"\"` = \"1\"",
+             command => "/usr/bin/su postgres -c \"/usr/bin/psql postgres postgres -c \
+                         \\\"CREATE USER ${name} WITH PASSWORD '${password}' ${roles}\\\"\""}}
     'dropped': {
       exec{"drop_${name}_postgres_user":
-             onlyif  => "/usr/bin/test `psql postgres postgres -P tuples_only -c \"select count(*) from pg_user where usename='${name}';\"` = \"1\"",
-             command => "/usr/bin/psql postgres postgres -c \
-                         \"DROP USER ${name}\""}}
+             onlyif  => "/usr/bin/test `/usr/bin/su postgres -c \"psql postgres postgres -P tuples_only -c \\\"select count(*) from pg_user where usename='${name}';\\\"\"` = \"1\"",
+             command => "/usr/bin/su postgres -c \"/usr/bin/psql postgres postgres -c \
+                         \\\"DROP USER ${name}\\\"\""}}
   }
 }
-- 
1.7.10.2




More information about the aeolus-devel mailing list