[PATCH configure] BZ #850571 - replace insecure postgres initdb w/ standard secure approach
John Eckersberg
jeckersb at redhat.com
Fri Aug 24 21:11:54 UTC 2012
Mo Morsi <mmorsi at redhat.com> writes:
> + exec{ "pgauthuser":
> + command => "/usr/bin/sed -i s/ident/md5/ /var/lib/pgsql/data/pg_hba.conf",
Did you mean s/trust/ident/ here?
> + require => Exec["pginitdb"],
> + notify => Service["postgresql"]
> + }
This exec ends up running on each invocation of configure, which means
the postgres service gets notified each run (and restarted). I'm seeing
intermittent failures on various things later on in the configure run
(mostly temp-admin user stuff) like:
err: /Stage[main]/Aeolus::Profiles::Common/Aeolus::Conductor::Login[temporary-administrative-user-4107fa646e268357fba1d0ef4d075c8c491a6179f9beffe7]/Web_request[temporary-administrative-user-4107fa646e268357fba1d0ef4d075c8c491a6179f9beffe7-conductor-login]/post: change from to https://localhost/conductor/user_session failed: An exception was raised when invoking web request: Invalid HTTP Return Code: 500,
was expecting one of 200
with the matching rails exception:
ActiveRecord::StatementInvalid (PGError: no connection to the server
: SELECT "sessions".* FROM "sessions" WHERE "sessions"."session_id" = '9ea0c1c3080158cee1f7ebf6bd0f7749' LIMIT 1):
So it looks like the postgres init script doesn't block for a complete
reload, and the server is restarting somewhere in the middle of the
configure run while we are trying to use it.
We can get around this by adding to the pgauthuser exec:
onlyif => "/bin/grep -q trust /var/lib/pgsql/data/pg_hba.conf"
This was all testing on a previously-configured host; I'm going to
reprovision and sanity check a clean host now.
More information about the aeolus-devel
mailing list