Jira (PDB-5062) Remove password entry from database.ini when using certificate authentication

Austin Blatt (Jira)

unread,

Mar 12, 2021, 3:29:03 PM3/12/21

to puppe...@googlegroups.com

Austin Blatt created an issue

PuppetDB /

PDB-5062

Remove password entry from database.ini when using certificate authentication

Issue Type:	Improvement
Assignee:	Unassigned
Created:	2021/03/12 12:28 PM
Priority:	Normal
Reporter:	Austin Blatt

PDB-5061 will limit our options with this ticket as just removing the password entry in database.ini will cause issues on current versions of PuppetDB.

We want to ensure users remove the password from their config files for a number of reasons. Primarily, it is more secure to not have that password. But additionally, the ordering of auth rules in pg_hba.conf determines whether or not we use password or certificate authentication with the database so removing the password entry gives us greater certainty that we are actually using certificate authentication and not still relying on password authentication.