[PATCH configure] BZ #850571 - remove permissive postgres hba config, use postgres system user instead

Mo Morsi mmorsi at redhat.com
Thu Aug 23 20:10:05 UTC 2012


---
 recipes/aeolus/files/pg_hba-ssl.conf  |    7 -------
 recipes/aeolus/files/pg_hba.conf      |    4 ----
 recipes/aeolus/manifests/conductor.pp |   15 +--------------
 recipes/postgres/manifests/user.pp    |   12 ++++++------
 4 files changed, 7 insertions(+), 31 deletions(-)
 delete mode 100644 recipes/aeolus/files/pg_hba-ssl.conf
 delete mode 100644 recipes/aeolus/files/pg_hba.conf

diff --git a/recipes/aeolus/files/pg_hba-ssl.conf b/recipes/aeolus/files/pg_hba-ssl.conf
deleted file mode 100644
index 722867b..0000000
--- a/recipes/aeolus/files/pg_hba-ssl.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-# we are still leaving Unix-domain sockets open, if we want to disable
-# make sure to append "sslmode=require" and "-h localhost" to all psql
-# commands
-local all all trust
-hostssl all         all    127.0.0.1/32             md5
-hostssl all         all    ::1/128                  md5
-
diff --git a/recipes/aeolus/files/pg_hba.conf b/recipes/aeolus/files/pg_hba.conf
deleted file mode 100644
index ef3f6f5..0000000
--- a/recipes/aeolus/files/pg_hba.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-local all all trust
-host  all all 127.0.0.1 255.255.255.255 md5
-host  all all ::1/128 md5
-
diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp
index 30882c3..00c80e4 100644
--- a/recipes/aeolus/manifests/conductor.pp
+++ b/recipes/aeolus/manifests/conductor.pp
@@ -96,30 +96,17 @@ class aeolus::conductor inherits aeolus {
                owner   => 'postgres',
                group   => 'postgres',
                notify  => Service['postgresql'] }
-      file { "/var/lib/pgsql/data/pg_hba.conf":
-               source  => "puppet:///modules/aeolus/pg_hba-ssl.conf",
-               require => Exec["pginitdb"],
-               owner   => 'postgres',
-               group   => 'postgres',
-               notify  => Service['postgresql']}
       file { "/var/lib/pgsql/data/postgresql.conf":
                source  => "puppet:///modules/aeolus/postgresql.conf",
                require => Exec["pginitdb"],
                owner   => 'postgres',
                group   => 'postgres',
                notify  => Service['postgresql']}
-    } else {
-      file { "/var/lib/pgsql/data/pg_hba.conf":
-               source => "puppet:///modules/aeolus/pg_hba.conf",
-               require => Exec["pginitdb"],
-               owner   => 'postgres',
-               group   => 'postgres',
-               notify  => Service['postgresql']}
     }
     postgres::user{"aeolus":
                      password => "v23zj59an",
                      roles    => "CREATEDB",
-                     require  => [Service["postgresql"], File["/var/lib/pgsql/data/pg_hba.conf"]] }
+                     require  => Service["postgresql"] }
 
 
     # Create aeolus database
diff --git a/recipes/postgres/manifests/user.pp b/recipes/postgres/manifests/user.pp
index a910a2e..e767e1d 100644
--- a/recipes/postgres/manifests/user.pp
+++ b/recipes/postgres/manifests/user.pp
@@ -2,13 +2,13 @@ define postgres::user($ensure='created', $password="", $roles=""){
   case $ensure {
     'created': {
       exec{"create_${name}_postgres_user":
-             unless  => "/usr/bin/test `psql postgres postgres -P tuples_only -c \"select count(*) from pg_user where usename='${name}';\"` = \"1\"",
-             command => "/usr/bin/psql postgres postgres -c \
-                         \"CREATE USER ${name} WITH PASSWORD '${password}' ${roles}\""}}
+             unless  => "/usr/bin/test `/usr/bin/su postgres -c \"psql postgres postgres -P tuples_only -c \\\"select count(*) from pg_user where usename='${name}';\\\"\"` = \"1\"",
+             command => "/usr/bin/su postgres -c \"/usr/bin/psql postgres postgres -c \
+                         \\\"CREATE USER ${name} WITH PASSWORD '${password}' ${roles}\\\"\""}}
     'dropped': {
       exec{"drop_${name}_postgres_user":
-             onlyif  => "/usr/bin/test `psql postgres postgres -P tuples_only -c \"select count(*) from pg_user where usename='${name}';\"` = \"1\"",
-             command => "/usr/bin/psql postgres postgres -c \
-                         \"DROP USER ${name}\""}}
+             onlyif  => "/usr/bin/test `/usr/bin/su postgres -c \"psql postgres postgres -P tuples_only -c \\\"select count(*) from pg_user where usename='${name}';\\\"\"` = \"1\"",
+             command => "/usr/bin/su postgres -c \"/usr/bin/psql postgres postgres -c \
+                         \\\"DROP USER ${name}\\\"\""}}
   }
 }
-- 
1.7.10.2




More information about the aeolus-devel mailing list