[Gnumed-devel] Re: using dbconfig-common in gnumed

[Andreas Tille]

On Fri, 17 Dec 2004, Ian Haywood wrote:

> Ok, for some reason I thought you were. Well, I accept
> bootstrap-gm_db_syztem is here to stay.
Perhaps the reason is that Karsten sometimes speaks good things about Debian. 
;-)

> Am I correct in thinking this means we would only be partially using 
> dbconfig-common (presumably
> the debconf-using config script config script) and then using its answers to 
> construct
> a .conf file to feed to this script.
Well, I think in the future you will perhaps have some reasons to find a
method to simplify your config scripts.  But in the reality I guess that
a doctor will ask a service provider to install his box and thus the
service provider should be able to adapt a config file if necessary. (This
might include that a doctor is "his own" service provider like some of
you who are clever enough to do this - but this is not the normal case.)

> Would it be useful to let bootstrap-gm_db_system.py accept its
> configuration on stdin? This would avoid creating a password-containing
> file.
This makes things no better.  If you think about a command line interface
it makes it even worse. Every user is able to do a

      COLUMNS=1000 ps ax

and could see the arguments (including passwords) of your running bootstrap
process.
I see no real disadvantage in using a temporary file which is only readable
by root containing the password.  The only alternative I would see is makeing
something as it is done for the Debian postgres user: Do only allow local ident
authentification for user gm-dbowner and create a system user gm-dbowner
which has no password at all and can only be login via "su gm-dbowner" as
root.

> Andreas, this is now back to a purely packager issue, but is there any way I can
> help?
Well in the sense above I'm kind of service provider and have to deal with
these issues.  I think I'll come back if I have a real problem with this and
I think some code in GnuMed has to be changed to reach a certain goal.
Currently I'm just waiting for Sean to release his 0.8 version of his
DB infrastructure which sounded very promissing.

Kind regards

         Andreas.

--
http://fam-tille.de