mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-06 19:38:51 +02:00
Mike Reeves
8225d41661
- Deliver postgres super and app passwords via mounted 0600 secret files (POSTGRES_PASSWORD_FILE, SO_POSTGRES_PASS_FILE) instead of plaintext env vars visible in docker inspect output - Mount a managed pg_hba.conf that only allows local trust and hostssl scram-sha-256 so TCP clients cannot negotiate cleartext sessions - Restrict postgres.key to 0400 and ensure owner/group 939 - Set umask 0077 on so-postgres-backup output - Validate host values in so-stats-show against [A-Za-z0-9._-] before SQL interpolation so a compromised minion cannot inject SQL via a tag value - Coerce postgres:telegraf:retention_days to int before rendering into SQL - Escape single quotes when rendering pillar values into postgresql.conf - Own postgres tooling in /usr/sbin as root:root so a container escape cannot rewrite admin scripts - Gate ES migration TLS verification on esVerifyCert (default false, matching the elastic module's existing pattern)
35 lines
1.7 KiB
Bash
35 lines
1.7 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Create or update application user for SOC platform access
|
|
# This script runs on first database initialization via docker-entrypoint-initdb.d
|
|
# The password is properly escaped to handle special characters
|
|
if [ -z "${SO_POSTGRES_PASS:-}" ] && [ -n "${SO_POSTGRES_PASS_FILE:-}" ] && [ -r "$SO_POSTGRES_PASS_FILE" ]; then
|
|
SO_POSTGRES_PASS="$(< "$SO_POSTGRES_PASS_FILE")"
|
|
fi
|
|
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
|
|
DO \$\$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${SO_POSTGRES_USER}') THEN
|
|
EXECUTE format('CREATE ROLE %I WITH LOGIN PASSWORD %L', '${SO_POSTGRES_USER}', '${SO_POSTGRES_PASS}');
|
|
ELSE
|
|
EXECUTE format('ALTER ROLE %I WITH PASSWORD %L', '${SO_POSTGRES_USER}', '${SO_POSTGRES_PASS}');
|
|
END IF;
|
|
END
|
|
\$\$;
|
|
GRANT ALL PRIVILEGES ON DATABASE "$POSTGRES_DB" TO "$SO_POSTGRES_USER";
|
|
-- Lock the SOC database down at the connect layer; PUBLIC gets CONNECT
|
|
-- by default, which would let per-minion telegraf roles open sessions
|
|
-- here. They have no schema/table grants inside so reads fail, but
|
|
-- revoking CONNECT closes the soft edge entirely.
|
|
REVOKE CONNECT ON DATABASE "$POSTGRES_DB" FROM PUBLIC;
|
|
GRANT CONNECT ON DATABASE "$POSTGRES_DB" TO "$SO_POSTGRES_USER";
|
|
EOSQL
|
|
|
|
# Bootstrap the Telegraf metrics database. Per-minion roles + schemas are
|
|
# reconciled on every state.apply by postgres/telegraf_users.sls; this block
|
|
# only ensures the shared database exists on first initialization.
|
|
if ! psql -U "$POSTGRES_USER" -tAc "SELECT 1 FROM pg_database WHERE datname='so_telegraf'" | grep -q 1; then
|
|
psql -v ON_ERROR_STOP=1 -U "$POSTGRES_USER" -c "CREATE DATABASE so_telegraf"
|
|
fi
|