RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
От
McDermott, Becky
Тема
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
Дата
Msg-id
BY3PR09MB86271BB460206972302F1F96C8179@BY3PR09MB8627.namprd09.prod.outlook.com
Ответ на
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) (Michael Paquier)
Список
Дерево обсуждения
Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Rob Sargent <robjsargent@gmail.com>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Rob Sargent <robjsargent@gmail.com>
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Michael Paquier <michael@paquier.xyz>
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Tom Lane <tgl@sss.pgh.pa.us>
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Michael Paquier <michael@paquier.xyz>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Michael Paquier <michael@paquier.xyz>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Sehrope Sarkuni <sehrope@jackdb.com>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Rob Sargent <robjsargent@gmail.com>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
> Is FIPS enabled on the host holding the PostgreSQL instance? I am afraid that you may run to run into problems in this case, in the shape of a crash in > > the backend. FIPS is enabled on each of our Kubernetes cluster nodes. We are running our application as Kubernetes deployments. I have observed the following: 1) The Postgres pod itself reaches a "Running" state 2) I have another pod in the same namespace with psql installed and I can exec into this pod and successfully connect to postgres and run SQL select statements 3) All other application pods (java services) that connect to postgres do NOT reach a "Running" state and their logs are full of messages stating a connection cannot be established with a cause indicating " Unsupported PBKDF2 for SCRAM-SHA-256" I am not a Java developer so I'm not sure how the postgres encryption method (SCRAM_SHA-256) was setup other than what I can see in the files: - postgresql.conf - pg_hba.conf Our developers are going to transition to working on this in a few weeks. I don't know enough about password encryption but it looks like we are using an unsupported algorithm on the java client side. > Postgres 14 is able to work by going through the EVP layer for its > SHA-2 computations, instead. Should we be looking at upgrading Postgres to version 14?
В списке pgsql-jdbc по дате отправления
От: Tom Lane
Дата:
От: Michael Paquier
Дата: