Skip to main content

Known Issues

Permissions on /etc/sicura​

On Sicura systems prior to Sicura 6.4, permissions on /etc/sicura were too restrictive for the sicura-console user to read license keys and configuration.

If it is not possible to upgrade Sicura to 6.4 or later (or to upgrade the sicura-sicura Puppet module to at least version 4.8.1), as a workaround set an ACL on the /etc/sicura directory with the following command:

setfacl -m u:sicura-console:rx /etc/sicura

Running in FIPS mode​

PostgreSQL 10 and later supports SCRAM-SHA-256 in leiu of md5. PostgreSQL 10 ships with the recommended installation platform, RHEL 8.

Manual configuration​

Follow the Install instructions as normal except:

  1. Change the 'sed' command s|ident|md5 to s|ident|scram-sha-256
  2. Run echo password_encryption=scram-sha-256 >> /var/lib/pgsql/data/postgresql.conf before starting postgres

Puppet configuration​

  1. In hiera, set postgresql::server::password_encryption: 'scram-sha-256'
  2. In sicura_console/manifests/db.pp, update it to include:
class { 'postgresql::globals':
  pg_hba_conf_defaults => false,
}

postgresql::server::pg_hba_rule {
  # Here, duplicate the out-of-the-box pg_hba.conf settings, 
  # pass a variable for the auth_method, where applicable 
  # allowing both md5 or scram-sha-256.
}

Note: Even after these changes to your environment you still may experience some non-idempotent issues with postgres.