mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-02 17:37:58 +02:00
Mike Reeves
868cd11874
Phase 1 of the PostgreSQL central data platform: - Salt states: init, enabled, disabled, config, ssl, auth, sostatus - TLS via SO CA-signed certs with postgresql.conf template - Two-tier auth: postgres superuser + so_postgres application user - Firewall restricts port 5432 to manager-only (HA-ready) - Wired into top.sls, pillar/top.sls, allowed_states, firewall containers map, docker defaults, CA signing policies, and setup scripts for all manager-type roles
98 lines
2.9 KiB
Plaintext
98 lines
2.9 KiB
Plaintext
x509_signing_policies:
|
|
filebeat:
|
|
- minions: '*'
|
|
- signing_private_key: /etc/pki/ca.key
|
|
- signing_cert: /etc/pki/ca.crt
|
|
- C: US
|
|
- ST: Utah
|
|
- L: Salt Lake City
|
|
- basicConstraints: "critical CA:false"
|
|
- keyUsage: "digitalSignature, nonRepudiation"
|
|
- subjectKeyIdentifier: hash
|
|
- authorityKeyIdentifier: keyid,issuer:always
|
|
- days_valid: 820
|
|
- copypath: /etc/pki/issued_certs/
|
|
registry:
|
|
- minions: '*'
|
|
- signing_private_key: /etc/pki/ca.key
|
|
- signing_cert: /etc/pki/ca.crt
|
|
- C: US
|
|
- ST: Utah
|
|
- L: Salt Lake City
|
|
- basicConstraints: "critical CA:false"
|
|
- keyUsage: "critical keyEncipherment"
|
|
- subjectKeyIdentifier: hash
|
|
- authorityKeyIdentifier: keyid,issuer:always
|
|
- extendedKeyUsage: serverAuth
|
|
- days_valid: 820
|
|
- copypath: /etc/pki/issued_certs/
|
|
managerssl:
|
|
- minions: '*'
|
|
- signing_private_key: /etc/pki/ca.key
|
|
- signing_cert: /etc/pki/ca.crt
|
|
- C: US
|
|
- ST: Utah
|
|
- L: Salt Lake City
|
|
- basicConstraints: "critical CA:false"
|
|
- keyUsage: "critical keyEncipherment digitalSignature"
|
|
- subjectKeyIdentifier: hash
|
|
- authorityKeyIdentifier: keyid,issuer:always
|
|
- extendedKeyUsage: serverAuth
|
|
- days_valid: 820
|
|
- copypath: /etc/pki/issued_certs/
|
|
influxdb:
|
|
- minions: '*'
|
|
- signing_private_key: /etc/pki/ca.key
|
|
- signing_cert: /etc/pki/ca.crt
|
|
- C: US
|
|
- ST: Utah
|
|
- L: Salt Lake City
|
|
- basicConstraints: "critical CA:false"
|
|
- keyUsage: "critical keyEncipherment"
|
|
- subjectKeyIdentifier: hash
|
|
- authorityKeyIdentifier: keyid,issuer:always
|
|
- extendedKeyUsage: serverAuth
|
|
- days_valid: 820
|
|
- copypath: /etc/pki/issued_certs/
|
|
postgres:
|
|
- minions: '*'
|
|
- signing_private_key: /etc/pki/ca.key
|
|
- signing_cert: /etc/pki/ca.crt
|
|
- C: US
|
|
- ST: Utah
|
|
- L: Salt Lake City
|
|
- basicConstraints: "critical CA:false"
|
|
- keyUsage: "critical keyEncipherment"
|
|
- subjectKeyIdentifier: hash
|
|
- authorityKeyIdentifier: keyid,issuer:always
|
|
- extendedKeyUsage: serverAuth
|
|
- days_valid: 820
|
|
- copypath: /etc/pki/issued_certs/
|
|
elasticfleet:
|
|
- minions: '*'
|
|
- signing_private_key: /etc/pki/ca.key
|
|
- signing_cert: /etc/pki/ca.crt
|
|
- C: US
|
|
- ST: Utah
|
|
- L: Salt Lake City
|
|
- basicConstraints: "critical CA:false"
|
|
- keyUsage: "digitalSignature, nonRepudiation"
|
|
- subjectKeyIdentifier: hash
|
|
- authorityKeyIdentifier: keyid,issuer:always
|
|
- days_valid: 820
|
|
- copypath: /etc/pki/issued_certs/
|
|
kafka:
|
|
- minions: '*'
|
|
- signing_private_key: /etc/pki/ca.key
|
|
- signing_cert: /etc/pki/ca.crt
|
|
- C: US
|
|
- ST: Utah
|
|
- L: Salt Lake City
|
|
- basicConstraints: "critical CA:false"
|
|
- keyUsage: "digitalSignature, keyEncipherment"
|
|
- subjectKeyIdentifier: hash
|
|
- authorityKeyIdentifier: keyid,issuer:always
|
|
- extendedKeyUsage: "serverAuth, clientAuth"
|
|
- days_valid: 820
|
|
- copypath: /etc/pki/issued_certs/
|