Andreas wrote:
> is there a documentation on how to secure a connection withe SSL?
> That is an option of the ODBC driver, isn't it?
>
> The motivation is that I need to rent a remote server for PG.
> Their admin proposes to open port 5432 on the outside of their
firewall
> but he has no idea how to secure the access besides PG's
user/password.
> I couldn't even restrict the accessing IPs within PG because they will
> be dynamic.
The ODBC driver uses libpq.dll to establish the connection, and
libpq.dll
can use SSL encryption, so you should have no problem.
You must enable SSL on the server (your provider, that is), by setting
'ssl = on' in postgresql.conf. There must be a server.key and server.crt
file in the PostgreSQL server data directory containing the private key
and the public certificate of the server.
Moreover, this only makes sense if you enforce it.
In pg_hba.conf on the server, add two lines like this:
hostssl all all 0.0.0.0/0 md5
host all all 0.0.0.0/0 reject
Then only SSL connections will be accepted.
This way you can also restrict connections to be only allowed from
your subnet - just change the IP address and netmask in the 'hostssl'
line to match your subnet.
Yours,
Laurenz Albe