RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)

Поиск
Список
Период
Сортировка
Искать
От
McDermott, Becky
Тема
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256)
Дата
Msg-id
BY3PR09MB86271BB460206972302F1F96C8179@BY3PR09MB8627.namprd09.prod.outlook.com
Ответ на
Список
Дерево обсуждения
Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Rob Sargent <robjsargent@gmail.com>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Michael Paquier <michael@paquier.xyz>
Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Michael Paquier <michael@paquier.xyz>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
Re: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) Dave Cramer <davecramer@postgres.rocks>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
RE: [EXTERNAL] Re: Java client connection problem on FIPS enabled hosts (with password_encryption = scram-sha-256) "McDermott, Becky" <bmcderm@sandia.gov>
> Is FIPS enabled on the host holding the PostgreSQL instance?  I am afraid that you may run to run into problems in this case, in the shape of a crash in > > the backend.

FIPS is enabled on each of our Kubernetes cluster nodes.  We are running our application as Kubernetes deployments.  I have observed the following:

1) The Postgres pod itself reaches a "Running" state
2) I have another pod in the same namespace with psql installed and I can exec into this pod and successfully connect to postgres and run SQL select statements
3) All other application pods (java services) that connect to postgres do NOT reach a "Running" state and their logs are full of messages stating a connection cannot be established with a cause indicating " Unsupported PBKDF2 for SCRAM-SHA-256"

I am not a Java developer so I'm not sure how the postgres encryption method (SCRAM_SHA-256) was setup other than what I can see in the files:
- postgresql.conf
- pg_hba.conf

Our developers are going to transition to working on this in a few weeks.  I don't know enough about password encryption but it looks like we are using an unsupported algorithm on the java client side.

> Postgres 14 is able to work by going through the EVP layer for its
> SHA-2 computations, instead.

Should we be looking at upgrading Postgres to version 14?



В списке pgsql-jdbc по дате отправления
От: Michael Paquier
Дата:
FAQ