Bug 820624 – [RFE] Have PostgreSQL only listen on 127.0.0.1 instead of 127.0.0.1 and 0.0.0.0

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 820624 - [RFE] Have PostgreSQL only listen on 127.0.0.1 instead of 127.0.0.1 and 0.0.0.0

Summary:	[RFE] Have PostgreSQL only listen on 127.0.0.1 instead of 127.0.0.1 and 0.0.0.0

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Satellite 6
Classification:	Red Hat
Component:	Installer (Show other bugs)
Sub Component:
Version:	6.0.0
Hardware:	All All

Priority	unspecified Severity medium (vote)
Target Milestone:	Unspecified
Target Release:	Unused
Assigned To:	Lukas Zapletal
QA Contact:	Garik Khachikyan
Docs Contact:

URL:
Whiteboard:
Keywords:	FutureFeature, Triaged

Depends On:	819611
Blocks:	836071
	Show dependency tree / graph

Reported:	2012-05-10 10:08 EDT by Eric Sammons
Modified:	2015-01-04 16:59 EST (History)
CC List:	8 users (show)

See Also:
Fixed In Version:
Doc Type:	Enhancement
Doc Text:	PostgreSQL listened on localhost and all network IPs. Aervices like candlepin only talk to PostgreSQL locally. This fix changes PostgreSQL to listen only on localhost for security purposes.
Story Points:	---
Clone Of:	819611
Environment:
Last Closed:	2012-12-04 14:45:27 EST
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2012:1543	normal	SHIPPED_LIVE	Important: CloudForms System Engine 1.1 update	2012-12-04 19:39:57 EST

Groups: None (edit)

Description Eric Sammons 2012-05-10 10:08:09 EDT

+++ This bug was initially created as a clone of Bug #819611 +++

Description of problem:

SAM 1.0 uses the PostgreSQL database. By default it listens on localhost (good) and all network IP's (bad). SAM only needs to talk to PostgreSQL locally, removing the network listening from all IP's would significantly reduce the attack surface of PostgreSQL with no impact to the SAM product. 

Assuming SAM keeps the config files in the normal locations simply edit:

/var/lib/pgsql/data/postgresql.conf 

and ensure the line 

listen_addresses = 'localhost'

is present. 

How reproducible:

Always

Steps to Reproduce:
1. Install SAM
2. netstat -vatn - postgresql is listneing on 0.0.0.0:5432
3.
  
Actual results:


Expected results:


Additional info:

NOT sure if this will apply to CFSE as I'm not clear if CFSE will support external databases (like Satellite)  please vet and close if not applicable.

Comment 1 Lukas Zapletal 2012-05-15 05:46:09 EDT

Yeah, this is valid request I guess. But I am testing it right now if it does not hurt us. Candlepin use PGSQL too, not sure if they both connect to localhost.

Comment 2 Miroslav Suchý 2012-08-06 07:54:19 EDT

fixed in katello.git in commit aa6286b

Comment 4 Garik Khachikyan 2012-10-05 04:32:29 EDT

# VERIFIED

Fixed. there is no:
---
tcp        0      0 0.0.0.0:5432                0.0.0.0:*                   LISTEN      16940/postmaster    

checked on:
---
katello-configure-1.1.9-6.el6cf.noarch
katello-1.1.12-12.el6cf.noarch

Comment 6 errata-xmlrpc 2012-12-04 14:45:27 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-1543.html

Note You need to log in before you can comment on or make changes to this bug.