opscode-cookbooks/postgresql — pull request #31 by davidc-donorschoose (2013-01-07 02:29:28+00:00)
Title: (COOK-2163) Consistently code for the postgres encrypted password (it isn't plain text) 

Summary of Changes
================

In the changes I am submitting, I decided to standardize on use as the encrypted password since `ALTER ROLE postgres ENCRYPTED PASSWORD '#{node['postgresql']['password']['postgres']}';` is the original code used to install the password in the `bash "assign-postgres-password"` resource.

(1) Code/documentation changes so the `node['postgresql']['password']['postgres']` attribute is consistently treated as the encrypted password (i.e, an md5 digested value). A previously coded, some uses (especially the README.md documentation) assumed the node attribute held the plain text password, which was dangerous and could lead to a DevOps disabling the `postgres` superuser password by accident.

(2) The `templates/default/pg_hba.conf.erb` was expanded with the helpful commentary, which tracks changes introduced in PostgreSQL versions 8.4, 9.0, 9.1 and 9.2. The existing code to expand authorizaiton rules with `node['postgresql']['pg_hba']` attributes remains, but I added a 'local all all ident' rule that is essential for this cookbook without access to the plain text password. This really is perfectly secure.

(3) My changes do not fix chef-server runs, which effectively disable `postgres` password login if the recipe generates a random password. As originally coded, this flaw existed, so I just added TODO comments as warnings to DevOps users and to future cookbook authors.