Re: SSL Support? - Mailing list pgsql-odbc

Hi Mitch,

there will be no point in the faq's concerning the setup of secure
tunnels since it's no *PART* of postgresql but a way of *USING* it.

Setting up an SSL tunnel is really easy:

1. Get Stunnel (www.stunnel.org)
2. Unpack on Client, Unpack on Server
3. Run on Server:
   stunnel-3.20.exe -p <pem-file> -d <sslextport> -r localhost:<dbport>
4. Run on Client:
   stunnel-3.20.exe -c -d <localport> -r <server>:<sslextport>
5. Make your ODBC connection (yes I mean client side) listening
   to localhost:<localport>
6. See it working

Now, if all works and you want to make it bombsafe, change your
database configuration to only accept new connections from the
inside "localhost"/"127.0.0.1" but no hosts else. The only way
the data can be still accessed, is from your brand new ssl tunnel
or the server machine itself.

You see it requires minimal a certificate (i.e. *.pem-file) on the
server side (optional on client side) suggesting you already got a
working certificate from your root authority. Get a simple (free)
certificate only for testing purposes from www.thawte.com.

They will contact you if you need a personal identity certificate
or a root key so you can be your own root authority, giving out
identity certs to your customers or workers or anybody else.

The Scheme is easy to understand:

[Server]   SSL-Port [ ]<----- SSL on TC/IP ----->[ ] SSL-Port   [Client]
   |                 |                            |                |
   |                 |                            |                |
   |        (stunnel sitting here)       (stunnel sitting here)    |
   |             (trusted)                        |                |
   |                 |                            |                |
  [ ] DB-Port        |                            |       DB-Port [ ]
   |_________________|                            |________________|


That's just a sample config, working locally here on my machine, for a
custom project to be moved to internet soon. I only need to change the
hosts in config files from "localhost" to the corresponding server ip
address. I use newest winxp+mysql and rhlinux/pgsql the stuff works
fine on both systems (better should I say worlds?).

I hope, I lightened it out enough.

Regards from germany,

Klemens Seydel
AM-Soft - IT-Systeme

          Hameln         Leipzig         Potsdam          Berlin
Tel.:  05151-9468-0   034206-6593-0    0331-743881-0    030-8058693-0
Fax :  05151-9468-88  034206-6593-88   0331-743881-31   030-8058693-88
         email : kseydel@am-soft.de       http://www.am-soft.de



----- Original Message -----
From: "Mitch Vincent" <mitch@doot.org>
To: <pgsql-odbc@postgresql.org>
Sent: Wednesday, January 23, 2002 9:01 PM
Subject: Re: [ODBC] SSL Support?


> Thanks!
>
> I did check out the website and can't seem to find a link to a FAQ (and
the
> documentation didn't mention SSL as far as I could find).. Perhaps I'm
> mistaken, sometimes things hide in plain view with me :-)
>
> -Mitch
>
> ----- Original Message -----
> From: "Cedar Cox" <cedarc@visionforisrael.com>
> To: "Mitch Vincent" <mitch@doot.org>
> Sent: Wednesday, January 23, 2002 1:46 PM
> Subject: Re: [ODBC] SSL Support?
>
>
> >
> > No. (um.. IIRC.  Read the docs/faqs). Use something like ssh tunnels..
> > You should probably visit http://odbc.postgresql.org
> >
> > -Cedar
> >
> > On Wed, 23 Jan 2002, Mitch Vincent wrote:
> >
> > > I'm new to ODBC, and Windows programming (though I've been programming
> with
> > > PostgreSQL for years, never with ODBC from Windows.)
> > >
> > > Is there any SSL support in the ODBC driver for PostgreSQL ?
> > >
> > > Thanks!
> > >
> > > -Mitch
> > >
> >
> >
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 6: Have you searched our list archives?
>
> http://archives.postgresql.org
>