堆棧內存溢出
  簡體   English   中英

我可以在SELinux中使用.pgpass嗎？ [centos7，pgagent_96，postgresql 9.6.5]

[英]Can I use .pgpass in SELinux? [centos7, pgagent_96, postgresql 9.6.5]

 原文  2017-10-19 03:51:41  9   1    postgresql/ centos7/ selinux/ pgadmin-4/ pgagent

問題描述

.pgpass似乎無法正常工作。 你能查一下我的行李設置嗎？ 

OS : centos 7   ( I did NOT disable selinux )

Database : postgresql 9.6.5

pgagent : pgagent_96 3.4.0-9.rhel7  ( installed package using  yum )
  1. 我以用戶'frank'登錄centos服務器

  2. 在開始pgagent之前，我檢查了pgagent的狀態。 （我沒有啟用pgagent_96服務。） 

     [frank@web]$ systemctl status pgagent_96.service ● pgagent_96.service - PgAgent for PostgreSQL 9.6 Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled) Active: inactive (dead)

  3. 我開始了pgagent。 起初它看起來很成功。 但經過幾十秒，它未能建立連接而死亡。 （雖然啟動CentOs問我frank的操作系統密碼。） 

     [frank@web]$ systemctl start pgagent_96.service [frank@web]$ systemctl status pgagent_96.service ● pgagent_96.service - PgAgent for PostgreSQL 9.6 Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled) Active: active (running) since 2017-10-16 16:42:11 KST; 5s ago Process: 9507 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS) Main PID: 9510 (pgagent_96) CGroup: /system.slice/pgagent_96.service └─9510 /usr/bin/pgagent_96 -s /var/log/pgagent_96.log hostaddr=127.0.0.1 dbname=postgres user=postgres port=5432 16 Oct 16:42:11 web.frank.net systemd[1]: Starting PgAgent for PostgreSQL 9.6... 16 Oct 16:42:11 web.frank.net systemd[1]: Started PgAgent for PostgreSQL 9.6.

（幾秒鍾后......） 

   [frank@web]$ systemctl status pgagent_96.service
    ● pgagent_96.service - PgAgent for PostgreSQL 9.6
       Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since 2017-10-16 16:42:56 KST; 4min 9s ago
      Process: 9507 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS)
     Main PID: 9510 (code=exited, status=1/FAILURE)

    16 Oct 16:42:11 web.frank.net systemd[1]: Starting PgAgent for PostgreSQL 9.6...
    16 Oct 16:42:11 web.frank.net systemd[1]: Started PgAgent for PostgreSQL 9.6.
    16 Oct 16:42:56 web.frank.net systemd[1]: pgagent_96.service: main process exited, code=exited, status=1/FAILURE
    16 Oct 16:42:56 web.frank.net systemd[1]: Unit pgagent_96.service entered failed state.
    16 Oct 16:42:56 web.frank.net systemd[1]: pgagent_96.service failed.

  1. 我檢查了pgagent日志。 （登錄/var/log/pgagent_96.log） 

     WARNING: Couldn't create the primary connection (attempt 1): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 2): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 3): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 4): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 5): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 6): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 7): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 8): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 9): fe_sendauth: no password supplied WARNING: Couldn't create the primary connection (attempt 10): fe_sendauth: no password supplied ERROR: Stopping pgAgent: Couldn't establish the primary connection with the database server.

  2. 檢查了我的.pgpass文件。 （.pgpass在frank的主目錄中./ home / frank） 

     [frank@web]$ ls -alZ .pgpass -rw-------. frank frank unconfined_u:object_r:user_home_t:s0 .pgpass [frank@web]$ ls -al .pgpass -rw-------. 1 frank frank 43 16 Oct 16:23 .pgpass [frank@web]$ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [frank@web]$ id uid=1000(frank) gid=1000(frank) groups=1000(frank),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

  3. 檢查了我的pg_hba.conf。 

     [frank@web]$ su - postgres -bash-4.2$ pwd /var/lib/pgsql/9.6/data -bash-4.2$ ls -alZ pg_hba.conf -rw-------. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 pg_hba.conf( pg_hba.conf )

[pg_hba.conf的內容] 

# TYPE  DATABASE        USER            ADDRESS                 METHOD
# "local" is for Unix domain socket connections only
#local   all             all                                     peer
local   all             all                                md5

# IPv4 local connections:
#host    all             all             127.0.0.1/32            ident
host    all   all   122.32.2.21/32       md5    (122.32.2.21  is my server's IP )

# IPv6 local connections:
#host    all             all             ::1/128                 ident
host    all             all             ::1/128                 md5

# Allow replication connections from localhost, by a user with the
# replication privilege.
#local   replication     postgres                                peer
#host    replication     postgres        127.0.0.1/32            ident
#host    replication     postgres        ::1/128                 ident

  1. 我這樣更改了postgres用戶的密碼。 

     postgres=# ALTER USER postgres WITH PASSWORD 'pwd';

  2. .pgpass文件的內容。 

     localhost:5432:postgres:postgres:pwd

  3. 我將.pgpass的所有者，團體從frank改為postgres。 但結果是一樣的。 我為OS用戶'root'（/ root），'postgres'（/ var / lib / pgsql）和其他兩個在/ home中有主目錄的普通用戶測試了同樣的東西。

（1）嘗試以OS用戶'root'身份啟動 

    [root@web frank]# ls -al .pgpass
    -rw-------. 1 postgres postgres 43 10월 16 17:08 .pgpass
    [root@web frank]# ls -alZ .pgpass
    -rw-------. postgres postgres unconfined_u:object_r:user_home_t:s0 .pgpass
    [root@web frank]# cat .pgpass
    localhost:5432:postgres:postgres:pwd
    [root@web frank]# systemctl start pgagent_96      (Here, centos asked frank's OS password )
    [root@web frank]# systemctl status pgagent_96
    ● pgagent_96.service - PgAgent for PostgreSQL 9.6
       Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since 2017-10-16 23:33:15 KST; 3s ago
      Process: 25928 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS)
     Main PID: 25930 (code=exited, status=1/FAILURE)

    16 Oct 23:32:30 web.frank.net systemd[1]: Starting PgAgent for Postgre....
    16 Oct 23:32:30 web.frank.net systemd[1]: Started PgAgent for PostgreS....
    16 Oct 23:33:15 web.frank.net systemd[1]: pgagent_96.service: main pro...E
    16 Oct 23:33:15 web.frank.net systemd[1]: Unit pgagent_96.service ente....
    16 Oct 23:33:15 web.frank.net systemd[1]: pgagent_96.service failed.
    Hint: Some lines were ellipsized, use -l to show in full.

（2）嘗試以操作系統用戶'坦誠'開始 

    [frank@web ~]$ systemctl start pgagent_96    (Here, centos asked frank's OS password )
    [frank@web ~]$ systemctl status pgagent_96
    ● pgagent_96.service - PgAgent for PostgreSQL 9.6
       Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since 월 2017-10-16 23:41:03 KST; 1min 21s ago
      Process: 26531 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS)
     Main PID: 26533 (code=exited, status=1/FAILURE)

    16 Oct 23:40:18 web.frank.net systemd[1]: Starting PgAgent for Postgre....
    16 Oct 23:40:18 web.frank.net systemd[1]: Started PgAgent for PostgreS....
    16 Oct 23:41:03 web.frank.net systemd[1]: pgagent_96.service: main pro...E
    16 Oct 23:41:03 web.frank.net systemd[1]: Unit pgagent_96.service ente....
    16 Oct 23:41:03 web.frank.net systemd[1]: pgagent_96.service failed.
    Hint: Some lines were ellipsized, use -l to show in full.

（3）嘗試以OS用戶'postgres'開始 

    -bash-4.2$ systemctl start pgagent_96       (Here, centos asked frank's OS password )
    -bash-4.2$ systemctl status pgagent_96
    ● pgagent_96.service - PgAgent for PostgreSQL 9.6
       Loaded: loaded (/usr/lib/systemd/system/pgagent_96.service; disabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since 월 2017-10-16 23:54:22 KST; 21s ago
      Process: 27511 ExecStart=/usr/bin/pgagent_96 -s ${LOGFILE} hostaddr=${DBHOST} dbname=${DBNAME} user=${DBUSER} port=${DBPORT} (code=exited, status=0/SUCCESS)
     Main PID: 27515 (code=exited, status=1/FAILURE)

（4）'root'，'frank'和'postgres'的安全上下文

（ 根 ） 

[root@web ~]# id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

（坦率地說） 

[frank@web ~]$ id
uid=1000(frank) gid=1000(frank) groups=1000(frank),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

（postgres） 

-bash-4.2$ id
uid=26(postgres) gid=26(postgres) groups=26(postgres) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

  1. 當然，我可以像這樣登錄數據庫。 但是我不能使用.pgpass文件。 

     [root@web bin]# su - postgres -bash-4.2$ psql -h localhost -U postgres psql (9.6.5) postgres=#

  2. 目前，我認為這個問題可能與.pgpass的安全上下文有關。 pgagent_96或systemd可能不被允許讀取.pgpass文件...（只是我的猜測^^）我檢查了pgagent_96或systemd是否可以讀取.pgpass。

（1）我在/ etc / profile中設置了PGPASSFILE變量[/ etc / profile的內容] 

export PGDATA=/var/lib/pgsql/9.6/data
export PGPASSFILE=/var/lib/pgsql/.pgpass

（2）嘗試啟動pgagent_96將.pgpass上下文類型從user_home_t更改為postgresql_db_t，bin_t，usr_t。 但我得到了同樣的錯誤。 

-bash-4.2$ echo $PGPASSFILE
/var/lib/pgsql/.pgpass
-bash-4.2$ ls -alZ .pgpass
-rw-------. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 .pgpass
-bash-4.2$ systemctl start pgagent_96
     ====> failed to start pgAgent_96. same error.
-bash-4.2$ chcon --type bin_t .pgpass
-bash-4.2$ ls -alZ .pgpass
-rw-------. postgres postgres unconfined_u:object_r:bin_t:s0   .pgpass
-bash-4.2$ systemctl start pgagent_96
    ====> failed to start pgAgent_96. same error.
-bash-4.2$ chcon --type usr_t .pgpass
-bash-4.2$ ls -alZ .pgpass
-rw-------. postgres postgres unconfined_u:object_r:usr_t:s0   .pgpass
-bash-4.2$ systemctl start pgagent_96
    ====> failed to start pgAgent_96. same error.

[pgagent_96，systemd，pg_hba.conf的安全上下文] 

[root@web frank]# ls -alZ /usr/bin/pgagent_96
-rwxr-xr-x. root root system_u:object_r:bin_t:s0   /usr/bin/pgagent_96
[root@web frank]# ls -alZ /usr/lib/systemd/systemd
-rwxr-xr-x. root root system_u:object_r:init_exec_t:s0 /usr/lib/systemd/systemd
[root@web frank]# ls -alZ /var/lib/pgsql/9.6/data/pg_hba.conf
-rw-------. postgres postgres unconfined_u:object_r:postgresql_db_t:s0 /var/lib/pgsql/9.6/data/pg_hba.conf

現在，我不知道應該嘗試什么。 請幫幫我...

UPDATE

  1. 我安裝了postgresql 10，pgagent_10。 但結果是一樣的......我想用systemctl命令啟動pgagent。 我將啟用pagent服務以自動啟動pgagent服務。

1 個解決方案

解決方案1
 1 已采納  2018-02-07 16:28:53

我在CentOS 7遇到了同樣的問題。我的解決方案是：
首先，檢查服務腳本中的一些變量：

cat /usr/lib/systemd/system/pgagent_96.service

1）默認情況下User = pgagent和Group = pgagent - 這是.pgpass文件的所有者/組，
你需要設置
chown pgagent：pgagent .pgpass
chmod 0600 .pgpass
2）接下來，將.pgpass文件移動到用戶pgagent可以讀取該文件的目錄中
（/ home / frank不能為用戶pgagent重做，例如，試試你的postgres安裝目錄/var/lib/pgsql/9.6或/ var / lib / pgsql）
3）檢查pgagent_96配置的位置變量，
默認情況下， EnvironmentFile = / etc / pgagent / pgagent_96.conf - 您需要編輯此文件。

下一步，在編輯器中打開pgagent_96.conf並進行更改：
a）更改變量DBHOST = localhost的值（這很重要）
b）添加變量PGPASSFILE = / path / your / pgpasfile / .pgpass（PGPASSFILE = / var / lib / pgsql / .pgpass）

在我的情況下，pgagent開始沒有問題。

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 pgagent-沒有運行的作業-pgpass文件正確-Postgresql python 在連接到 PostgreSQL 時不能使用 .pgpass 我無法在 Postgresql 上的 PgAgent 上運行作業 我可以在邏輯復制中使用.pgpass嗎？ 如何在 Windows 上為 PostgreSQL 9.5 安裝 pgAgent？ 如何在centos7上為PostgreSQL 9.2運行initdb？ PostgreSQL pgAgent的工作無法正常工作 pgagent centos 6.2 SELinux CentOS-7，創建表空間PostgreSQL時出現問題 postgresql：.pgpass 不工作
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM