Need a wee bit more info on PostgreSQL's SSL security options - Mailing list pgsql-general

From Andreas
Subject Need a wee bit more info on PostgreSQL's SSL security options
Date
Msg-id 4661ED5A.2050701@gmx.net
Whole thread Raw
Responses Re: Need a wee bit more info on PostgreSQL's SSL security options
List pgsql-general
Hi,

I've got it so far:
Server-OS: Debian 3.1 sarge
PostgreSQL: Debian's binary PG 8.1.8 (still the most recent version
available)

Following a tutorial (actually for OpenVPN as I didn't find any for PG
that goes beyond what is found in the main docu) I created a CA, server
and client certificate, updated postgresql.conf and pg_hba.conf, did a
restart of PG and connected from a windows box with pgAdmin.
NICE :)

Now as far as I see, even though I have my postgresql.crt+key in place,
I still have to provide username and password, right?

The server rejects my connection attempt if I move postgresql.crt+key
away. Thats to be expected.
Can I further check the security of the server? The aim will be to have
the port open to the Internet.

How can I check that PG accepts only keys produced by my CA?

What would be the correct  "Common Name"  of a client?

I read that the client can maintain a file  root.crt  to check the
identity of the db-server.
Is this the  root.crt  that sits in PG's data-directory or is it the
server.crt  ?

In the documentation there is a certificate-revocation-list-file mentioned.
I suspect this is to revoke a formerly granted key that got lost or is
owned by a person who shouldn't be allowed to access the dbms anymore.
How is this CRL file set up?


Is there a documentation, that covers those matters more deeply than
chapter 16.8 and 20.1 of PG's main documentation?
Especially the whole client-side topic is rather thin for a newbie.


Regards
Andreas



pgsql-general by date:

Previous
From: "Harpreet Dhaliwal"
Date:
Subject: Re: Transactional DDL
Next
From: "Jaime Casanova"
Date:
Subject: Re: Transactional DDL