Skip to content

Commit 1475311

Browse files
bastelfreakbastelfreak
authored
Merge pull request #343 from smortex/security-file-permissions
Restrict configuration file permissions
2 parents 3afd693 + 36a8cd8 commit 1475311

10 files changed

Lines changed: 28 additions & 36 deletions

File tree

‎manifests/server.pp‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -478,7 +478,6 @@
478478
conn_max_age => $conn_max_age,
479479
conn_lifetime => $conn_lifetime,
480480
confdir => $confdir,
481-
puppetdb_user => $puppetdb_user,
482481
puppetdb_group => $puppetdb_group,
483482
migrate => $migrate,
484483
notify => Service[$puppetdb_service],
@@ -510,7 +509,6 @@
510509
conn_max_age => $read_conn_max_age,
511510
conn_lifetime => $read_conn_lifetime,
512511
confdir => $confdir,
513-
puppetdb_user => $puppetdb_user,
514512
puppetdb_group => $puppetdb_group,
515513
notify => Service[$puppetdb_service],
516514
database_max_pool_size => $read_database_max_pool_size,
@@ -520,29 +518,29 @@
520518
file {
521519
$ssl_dir:
522520
ensure => directory,
523-
owner => $puppetdb_user,
521+
owner => 'root',
524522
group => $puppetdb_group,
525-
mode => '0700';
523+
mode => '0755';
526524
$ssl_key_path:
527525
ensure => file,
528526
content => $ssl_key,
529-
owner => $puppetdb_user,
527+
owner => 'root',
530528
group => $puppetdb_group,
531-
mode => '0600',
529+
mode => '0640',
532530
notify => Service[$puppetdb_service];
533531
$ssl_cert_path:
534532
ensure => file,
535533
content => $ssl_cert,
536-
owner => $puppetdb_user,
534+
owner => 'root',
537535
group => $puppetdb_group,
538-
mode => '0600',
536+
mode => '0644',
539537
notify => Service[$puppetdb_service];
540538
$ssl_ca_cert_path:
541539
ensure => file,
542540
content => $ssl_ca_cert,
543-
owner => $puppetdb_user,
541+
owner => 'root',
544542
group => $puppetdb_group,
545-
mode => '0600',
543+
mode => '0644',
546544
notify => Service[$puppetdb_service];
547545
}
548546
}
@@ -560,9 +558,9 @@
560558

561559
file { $ssl_key_pk8_path:
562560
ensure => file,
563-
owner => $puppetdb_user,
561+
owner => 'root',
564562
group => $puppetdb_group,
565-
mode => '0600',
563+
mode => '0640',
566564
notify => Service[$puppetdb_service],
567565
}
568566
}
@@ -583,7 +581,6 @@
583581
confdir => $confdir,
584582
max_threads => $max_threads,
585583
notify => Service[$puppetdb_service],
586-
puppetdb_user => $puppetdb_user,
587584
puppetdb_group => $puppetdb_group,
588585
}
589586

@@ -592,7 +589,6 @@
592589
certificate_whitelist => $certificate_whitelist,
593590
disable_update_checking => $disable_update_checking,
594591
confdir => $confdir,
595-
puppetdb_user => $puppetdb_user,
596592
puppetdb_group => $puppetdb_group,
597593
notify => Service[$puppetdb_service],
598594
}

‎manifests/server/database.pp‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
$conn_max_age = $puppetdb::params::conn_max_age,
2020
$conn_lifetime = $puppetdb::params::conn_lifetime,
2121
$confdir = $puppetdb::params::confdir,
22-
$puppetdb_user = $puppetdb::params::puppetdb_user,
2322
$puppetdb_group = $puppetdb::params::puppetdb_group,
2423
$database_max_pool_size = $puppetdb::params::database_max_pool_size,
2524
$migrate = $puppetdb::params::migrate,
@@ -50,9 +49,9 @@
5049

5150
file { $database_ini:
5251
ensure => file,
53-
owner => $puppetdb_user,
52+
owner => 'root',
5453
group => $puppetdb_group,
55-
mode => '0600',
54+
mode => '0640',
5655
}
5756

5857
$file_require = File[$database_ini]

‎manifests/server/jetty.pp‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,15 @@
1616
Optional[String] $cipher_suites = $puppetdb::params::cipher_suites,
1717
$confdir = $puppetdb::params::confdir,
1818
$max_threads = $puppetdb::params::max_threads,
19-
$puppetdb_user = $puppetdb::params::puppetdb_user,
2019
$puppetdb_group = $puppetdb::params::puppetdb_group,
2120
) inherits puppetdb::params {
2221
$jetty_ini = "${confdir}/jetty.ini"
2322

2423
file { $jetty_ini:
2524
ensure => file,
26-
owner => $puppetdb_user,
25+
owner => 'root',
2726
group => $puppetdb_group,
28-
mode => '0600',
27+
mode => '0640',
2928
}
3029

3130
# Set the defaults

‎manifests/server/puppetdb.pp‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,15 @@
66
$certificate_whitelist = $puppetdb::params::certificate_whitelist,
77
$disable_update_checking = $puppetdb::params::disable_update_checking,
88
$confdir = $puppetdb::params::confdir,
9-
$puppetdb_user = $puppetdb::params::puppetdb_user,
109
$puppetdb_group = $puppetdb::params::puppetdb_group,
1110
) inherits puppetdb::params {
1211
$puppetdb_ini = "${confdir}/puppetdb.ini"
1312

1413
file { $puppetdb_ini:
1514
ensure => file,
16-
owner => $puppetdb_user,
15+
owner => 'root',
1716
group => $puppetdb_group,
18-
mode => '0600',
17+
mode => '0640',
1918
}
2019

2120
# Set the defaults

‎manifests/server/read_database.pp‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
$conn_max_age = $puppetdb::params::read_conn_max_age,
1414
$conn_lifetime = $puppetdb::params::read_conn_lifetime,
1515
$confdir = $puppetdb::params::confdir,
16-
$puppetdb_user = $puppetdb::params::puppetdb_user,
1716
$puppetdb_group = $puppetdb::params::puppetdb_group,
1817
$database_max_pool_size = $puppetdb::params::read_database_max_pool_size,
1918
$postgresql_ssl_on = $puppetdb::params::postgresql_ssl_on,
@@ -44,9 +43,9 @@
4443

4544
file { $read_database_ini:
4645
ensure => file,
47-
owner => $puppetdb_user,
46+
owner => 'root',
4847
group => $puppetdb_group,
49-
mode => '0600',
48+
mode => '0640',
5049
}
5150

5251
$file_require = File[$read_database_ini]

‎spec/unit/classes/server/database_ini_spec.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@
2020
is_expected.to contain_file("#{pdbconfdir}/database.ini")
2121
.with(
2222
'ensure' => 'file',
23-
'owner' => 'puppetdb',
23+
'owner' => 'root',
2424
'group' => 'puppetdb',
25-
'mode' => '0600',
25+
'mode' => '0640',
2626
)
2727
}
2828
it {

‎spec/unit/classes/server/jetty_ini_spec.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@
2020
is_expected.to contain_file("#{pdbconfdir}/jetty.ini")
2121
.with(
2222
'ensure' => 'file',
23-
'owner' => 'puppetdb',
23+
'owner' => 'root',
2424
'group' => 'puppetdb',
25-
'mode' => '0600',
25+
'mode' => '0640',
2626
)
2727
}
2828
it {

‎spec/unit/classes/server/puppetdb_ini_spec.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@
3030
is_expected.to contain_file('/etc/puppetlabs/puppetdb/conf.d/puppetdb.ini')
3131
.with(
3232
'ensure' => 'file',
33-
'owner' => 'puppetdb',
33+
'owner' => 'root',
3434
'group' => 'puppetdb',
35-
'mode' => '0600',
35+
'mode' => '0640',
3636
)
3737
}
3838
it {

‎spec/unit/classes/server/read_database_ini_spec.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@
2020
is_expected.to contain_file('/etc/puppetlabs/puppetdb/conf.d/read_database.ini')
2121
.with(
2222
'ensure' => 'file',
23-
'owner' => 'puppetdb',
23+
'owner' => 'root',
2424
'group' => 'puppetdb',
25-
'mode' => '0600',
25+
'mode' => '0640',
2626
)
2727
}
2828
it {

‎spec/unit/classes/server_spec.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -210,9 +210,9 @@
210210
is_expected.to contain_file('/etc/puppetlabs/puppetdb/ssl/private.pk8')
211211
.with(
212212
ensure: 'file',
213-
owner: 'puppetdb',
213+
owner: 'root',
214214
group: 'puppetdb',
215-
mode: '0600',
215+
mode: '0640',
216216
)
217217
end
218218
end

0 commit comments

Comments
 (0)
⚡