Skip to content

Enforce SCRAM-SHA-256 DB Auth and Configurable LAN Networking#260

Open
tyronechrisharris wants to merge 1 commit intoBotts-Innovative-Research:mainfrom
tyronechrisharris:jules-sync-22716396113
Open

Enforce SCRAM-SHA-256 DB Auth and Configurable LAN Networking#260
tyronechrisharris wants to merge 1 commit intoBotts-Innovative-Research:mainfrom
tyronechrisharris:jules-sync-22716396113

Conversation

@tyronechrisharris
Copy link
Copy Markdown
Contributor

This submission enhances the security of the OSCAR system by implementing robust database authentication and flexible networking.

Key changes include:

  1. SCRAM-SHA-256 Enforcement: Updated the PostGIS Docker configuration to use SCRAM-SHA-256 authentication during initialization.
  2. Docker Secrets Integration: All launch and run scripts now generate a secure, random database password (stored in .db_password) and inject it into the container via POSTGRES_PASSWORD_FILE. The OSH Java backend has been modified to prioritize reading credentials from this secret file at runtime.
  3. Configurable LAN Networking: Added support for the DB_HOST environment variable across all launch scripts and the backend logic, allowing the database to be hosted on a separate machine on the same LAN.
  4. Secure Connectivity: The OSH backend now enforces TLS for all PostGIS connections by default (ssl=true).
  5. Cross-Platform Utilities: Created backup.sh/bat and restore.sh/bat in the repository root for safe and easy database maintenance, respecting the new security and networking configurations.
  6. Credential Sanitization: Removed all instances of the hardcoded "postgres" password from configuration files and scripts.

These changes were implemented while maintaining full compatibility with the OpenSensorHub framework and OSH persistence modules.

Fixes #28


🔄 Auto-Distributed via AI Sync

Original Flat Repo PR: tyronechrisharris/oscar-flat#39

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant