Re: Problem with ssl and psql in Postgresql 13 - Mailing list pgsql-general

From Kyotaro Horiguchi
Subject Re: Problem with ssl and psql in Postgresql 13
Date
Msg-id 20201225.113213.410382360814129474.horikyota.ntt@gmail.com
Whole thread Raw
In response to Re: Problem with ssl and psql in Postgresql 13  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-general
At Thu, 24 Dec 2020 11:54:32 -0500, Tom Lane <tgl@sss.pgh.pa.us> wrote in 
> I wrote:
> > Kyotaro Horiguchi <horikyota.ntt@gmail.com> writes:
> >> The attached the first patch does that.
> 
> > +1, it seems like a clear oversight that the GSSENC patches didn't adjust
> > these messages.  The reason SSL state is mentioned is that it's relevant
> > to which pg_hba entry gets chosen; and once we invented "hostgssenc"
> > entries, GSSENC state is also relevant.
> 
> Thinking a little more about that: there are not four distinct states,
> because GSS and SSL can't both be enabled (ProcessStartupPacket enforces
> that).  So I propose that instead of adding a new field, we make the
> existing field say one of three things: "GSS encryption", "SSL
> encryption", or "no encryption".  As per attached.  In the back branches,
> it might be best to spell these as "GSS encryption", "SSL on", and "SSL
> off", just to minimize the cosmetic change.

Looks good to me.

I tried the same case where

- did kinit
- pg_hba has hostssl line only

I saw the following lines in server log, which seems good.

FATAL:  no pg_hba.conf entry for host "192.168.56.101", user "horiguti@MYDOMAIN.COM", database "postgres", GSS
encryption
FATAL:  no pg_hba.conf entry for host "192.168.56.101", user "horiguti@MYDOMAIN.COM", database "postgres", no
encryption

regards.

-- 
Kyotaro Horiguchi
NTT Open Source Software Center



pgsql-general by date:

Previous
From: Adrian Klaver
Date:
Subject: Re: Missing rows after migrating from postgres 11 to 12 with logical replication
Next
From: Shantanu Shekhar
Date:
Subject: Stats for indexes on expressions