Re: proper pg_hba config to require ssl from non-local/private ips

Поиск
Список
Период
Сортировка
От Jeff Janes
Тема Re: proper pg_hba config to require ssl from non-local/private ips
Дата
Msg-id CAMkU=1zmeaZrLziKiYB62weDDMtQ1MpBb-6ja3M4=7D5HoSZmQ@mail.gmail.com
обсуждение исходный текст
Ответ на proper pg_hba config to require ssl from non-local/private ips  (Matthew Lenz <mlenz@nocturnal.org>)
Ответы Re: proper pg_hba config to require ssl from non-local/private ips  (Frank Gard <frank.von.postgresql.org@familie-gard.de>)
Re: proper pg_hba config to require ssl from non-local/private ips  (Matthew Lenz <mlenz@nocturnal.org>)
Re: proper pg_hba config to require ssl from non-local/private ips  (jagjit singh <jagjitsingh.ocp@gmail.com>)
Список pgsql-admin
Дерево обсуждения
On Wed, Oct 19, 2022 at 8:50 AM Matthew Lenz <mlenz@nocturnal.org> wrote:
This is what I've got currently but it's still allowing non-ssl connections from remote (non-local/private) hosts. Any thoughts?

Did you reload the server configurations after changing the file?  What is the address of that non-local host, as seen by the server? (you can check the first with `select * from pg_hba_file_rules`, and second with `select client_addr from pg_stat_activity where pid=pg_backend_pid();`
 

local   all             all                                     trust
host    all             all             127.0.0.1/32            trust
host    all             all             ::1/128                 trust
host    all             all             10.0.0.0/8              md5
host    all             all             172.16.0.0/12           md5
hostssl all             all             all                     md5 clientcert=verify-ca

Also when I require SSL on the client it allows SSL connections without a CA signed cert which I thought clientcert=verify-ca in this pg_hba should require.

No, clientcert=verify-ca forces the server to check the client's certificate.  Forcing the client to check the server's certificate must be done on the client end.  (And of course if you are not connecting via that line of the pg_hba, then that setting doesn't do anything.)

Cheers,

Jeff

В списке pgsql-admin по дате отправления:

Предыдущее
От: Laurenz Albe
Дата:
Сообщение: Re: proper pg_hba config to require ssl from non-local/private ips
Следующее
От: Thomas Kellerer
Дата:
Сообщение: Re: Database schema changes tools