Project

General

Profile

Actions
Copy link

Bug #20079

closed

Foreman does not verify CA on postgres DB connections with SSL

Added by Martin Bacovsky almost 7 years ago. Updated almost 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Martin Bacovsky
Category:
Foreman modules
Target version:
1.16.0
Difficulty:
Triaged:
Bugzilla link:
1052713
Pull request:
https://github.com/theforeman/puppet-foreman/pull/571
Fixed in Releases:
Found in Releases:
Foreman - Nightly
Red Hat JIRA:

Description

The default sslmode is 'prefer' which allows SSL connection to DB server, but CA of the DB server is not verified.

When using --foreman-db-sslmode 'verify-full' to enforce the CA cert verification there is no way to configure the root cert for the connection.
System CA trust is not supported by libpg and the cert is expected at '/usr/share/foreman/.postgresql/root.crt'.

Add an installer option to setup the root cert and consider if 'prefer' is the right and secure default option.

Related issues 2 (0 open — 2 closed)

Related to Installer - Bug #22940: foreman-installer does not create /usr/share/foreman/.postgresql/root.crtClosedEwoud Kohl van Wijngaarden03/20/2018Actions
Blocks Katello - Feature #19667: Need additional supported database deployment options for Katello installation: such as External PostgresClosedMartin Bacovsky05/25/2017Actions
Actions
Copy link

Also available in: Atom PDF