[PATCH] BZ #850571 - secure postgres access config - remove custom access config - use postgres-setup to generate secure config - switch ident (system user) auth to md5-passwd based accounts

Mo Morsi mmorsi at redhat.com
Thu Aug 30 16:59:27 UTC 2012


On 08/28/2012 03:52 PM, John Eckersberg wrote:
> Mo Morsi <mmorsi at redhat.com> writes:
>> ---
>>  recipes/aeolus/files/pg_hba-ssl.conf  |    7 -------
>>  recipes/aeolus/files/pg_hba.conf      |    4 ----
>>  recipes/aeolus/manifests/conductor.pp |   23 ++++++++---------------
>>  recipes/postgres/manifests/server.pp  |    4 +---
>>  recipes/postgres/manifests/user.pp    |   12 ++++++------
>>  5 files changed, 15 insertions(+), 35 deletions(-)
>>  delete mode 100644 recipes/aeolus/files/pg_hba-ssl.conf
>>  delete mode 100644 recipes/aeolus/files/pg_hba.conf
>>
>> diff --git a/recipes/aeolus/files/pg_hba-ssl.conf b/recipes/aeolus/files/pg_hba-ssl.conf
>> deleted file mode 100644
>> index 722867b..0000000
>> --- a/recipes/aeolus/files/pg_hba-ssl.conf
>> +++ /dev/null
>> @@ -1,7 +0,0 @@
>> -# we are still leaving Unix-domain sockets open, if we want to disable
>> -# make sure to append "sslmode=require" and "-h localhost" to all psql
>> -# commands
>> -local all all trust
>> -hostssl all         all    127.0.0.1/32             md5
>> -hostssl all         all    ::1/128                  md5
>> -
>> diff --git a/recipes/aeolus/files/pg_hba.conf b/recipes/aeolus/files/pg_hba.conf
>> deleted file mode 100644
>> index ef3f6f5..0000000
>> --- a/recipes/aeolus/files/pg_hba.conf
>> +++ /dev/null
>> @@ -1,4 +0,0 @@
>> -local all all trust
>> -host  all all 127.0.0.1 255.255.255.255 md5
>> -host  all all ::1/128 md5
>> -
>> diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp
>> index 30882c3..9fb8a66 100644
>> --- a/recipes/aeolus/manifests/conductor.pp
>> +++ b/recipes/aeolus/manifests/conductor.pp
>> @@ -96,37 +96,30 @@ class aeolus::conductor inherits aeolus {
>>                 owner   => 'postgres',
>>                 group   => 'postgres',
>>                 notify  => Service['postgresql'] }
>> -      file { "/var/lib/pgsql/data/pg_hba.conf":
>> -               source  => "puppet:///modules/aeolus/pg_hba-ssl.conf",
>> -               require => Exec["pginitdb"],
>> -               owner   => 'postgres',
>> -               group   => 'postgres',
>> -               notify  => Service['postgresql']}
>>        file { "/var/lib/pgsql/data/postgresql.conf":
>>                 source  => "puppet:///modules/aeolus/postgresql.conf",
>>                 require => Exec["pginitdb"],
>>                 owner   => 'postgres',
>>                 group   => 'postgres',
>>                 notify  => Service['postgresql']}
>> -    } else {
>> -      file { "/var/lib/pgsql/data/pg_hba.conf":
>> -               source => "puppet:///modules/aeolus/pg_hba.conf",
>> -               require => Exec["pginitdb"],
>> -               owner   => 'postgres',
>> -               group   => 'postgres',
>> -               notify  => Service['postgresql']}
>> +    }
>> +    exec{ "pgauthuser":
>> +      command     => "/usr/bin/sed -i s/ident/md5/ /var/lib/pgsql/data/pg_hba.conf",
>> +      onlyif      => '/bin/grep -q ident /var/lib/pgsql/data/pg_hba.conf',
>> +      require     => Exec["pginitdb"],
>> +      notify      => Service["postgresql"]
>>      }
>>      postgres::user{"aeolus":
>>                       password => "v23zj59an",
>>                       roles    => "CREATEDB",
>> -                     require  => [Service["postgresql"], File["/var/lib/pgsql/data/pg_hba.conf"]] }
>> +                     require  => Service["postgresql"] }
>>  
>>  
>>      # Create aeolus database
>>      aeolus::rails::create::db{"create_aeolus_database":
>>                  cwd        => "/usr/share/aeolus-conductor",
>>                  rails_env  => "production",
>> -                require    => [Postgres::User[aeolus], Package['aeolus-conductor']] }
>> +                require    => [Postgres::User[aeolus], Exec['pgauthuser'], Package['aeolus-conductor']] }
>>      aeolus::rails::migrate::db{"migrate_aeolus_database":
>>                  cwd             => "/usr/share/aeolus-conductor",
>>                  rails_env       => "production",
>> diff --git a/recipes/postgres/manifests/server.pp b/recipes/postgres/manifests/server.pp
>> index 09ea6d7..1bd4b28 100644
>> --- a/recipes/postgres/manifests/server.pp
>> +++ b/recipes/postgres/manifests/server.pp
>> @@ -24,9 +24,7 @@ class postgres::server inherits postgres {
>>      }
>>  
>>      exec { "pginitdb":
>> -        command         => "/usr/bin/initdb --pgdata='/var/lib/pgsql/data' -E UTF8",
>> -        user            => "postgres",
>> -        group           => "postgres",
>> +        command         => "/usr/bin/postgresql-setup initdb",
>>          creates         => "/var/lib/pgsql/data/PG_VERSION",
>>          require         => Package["postgresql-server"],
>>          notify          => Service["postgresql"],
>> diff --git a/recipes/postgres/manifests/user.pp b/recipes/postgres/manifests/user.pp
>> index a910a2e..e767e1d 100644
>> --- a/recipes/postgres/manifests/user.pp
>> +++ b/recipes/postgres/manifests/user.pp
>> @@ -2,13 +2,13 @@ define postgres::user($ensure='created', $password="", $roles=""){
>>    case $ensure {
>>      'created': {
>>        exec{"create_${name}_postgres_user":
>> -             unless  => "/usr/bin/test `psql postgres postgres -P tuples_only -c \"select count(*) from pg_user where usename='${name}';\"` = \"1\"",
>> -             command => "/usr/bin/psql postgres postgres -c \
>> -                         \"CREATE USER ${name} WITH PASSWORD '${password}' ${roles}\""}}
>> +             unless  => "/usr/bin/test `/usr/bin/su postgres -c \"psql postgres postgres -P tuples_only -c \\\"select count(*) from pg_user where usename='${name}';\\\"\"` = \"1\"",
>> +             command => "/usr/bin/su postgres -c \"/usr/bin/psql postgres postgres -c \
>> +                         \\\"CREATE USER ${name} WITH PASSWORD '${password}' ${roles}\\\"\""}}
>>      'dropped': {
>>        exec{"drop_${name}_postgres_user":
>> -             onlyif  => "/usr/bin/test `psql postgres postgres -P tuples_only -c \"select count(*) from pg_user where usename='${name}';\"` = \"1\"",
>> -             command => "/usr/bin/psql postgres postgres -c \
>> -                         \"DROP USER ${name}\""}}
>> +             onlyif  => "/usr/bin/test `/usr/bin/su postgres -c \"psql postgres postgres -P tuples_only -c \\\"select count(*) from pg_user where usename='${name}';\\\"\"` = \"1\"",
>> +             command => "/usr/bin/su postgres -c \"/usr/bin/psql postgres postgres -c \
>> +                         \\\"DROP USER ${name}\\\"\""}}
>>    }
>>  }
>> -- 
>> 1.7.10.2
> On existing installs, running aeolus-configure after applying this patch
> does not fix the existing problem.  In this case, the existing
> pg_hba.conf stays in place (as laid down by previous run(s) of
> configure) and that file still contains the 'local all all trust' bit.
>
> On a clean installation, this works as described.
>
> I don't know if the intention is to try and retroactively fix "bad"
> installs or not.  If not, then ACK, as this works fine in the clean
> install case.

Pushed this patch and just sent a follow up adding another hba
modification tightening up any instances of 'trust'. This should take
care of both the new / old cases.

If you had the cycles to look at it, I would appreciate it.

  -Mo




More information about the aeolus-devel mailing list