Thread: PostgreSQL with SSL

PostgreSQL with SSL

From
"Elvis Henríquez"
Date:
Greetings list.
I'm trying to upgrade my PostgreSQL 8.1.0 instalation in Red Hat Linux 9 (  PostgreSQL 8.1.0 on i686-pc-linux-gnu, compiled by GCC gcc (GCC) 3.2.2 20030222 (Red Hat Linux 3.2.2-5)   ) to version 8.1.4 cause of security patch just released.

Now I want to increase security in my connections to my database implementing SSL. I've already installed OpenSSH openssl-0.9.8b, but when configuring postgres ( ./configure --with-openssl  ) I get the following error:

[...]
checking openssl/ssl.h usability... no
checking openssl/ssl.h presence... no
checking for openssl/ssl.h... no
configure: error: header file <openssl/ssl.h> is required for OpenSSL

The file is located in /usr/local/include/openssl/ssl.h

I also copied the whole directory to [pgsrcdir]/include/openssl and the error remains.

I've also tried this: http://archives.postgresql.org/pgsql-admin/2003-11/msg00429.php and then I get this new error:

[...]
checking for library containing com_err... no
configure: error: could not find function 'com_err' required for Kerberos 5

Any idea about what am I doing wrong ? Have anybody compiled postgres with SSH in Red Hat 9 ? Thanks.

Re: PostgreSQL with SSL

From
Tom Lane
Date:
"=?ISO-8859-1?Q?Elvis_Henr=EDquez?=" <henriquez.elvis@gmail.com> writes:
> I'm trying to upgrade my PostgreSQL 8.1.0 instalation in Red Hat Linux 9 (
> PostgreSQL 8.1.0 on i686-pc-linux-gnu, compiled by GCC gcc (GCC)
> 3.2.220030222 (Red Hat Linux
> 3.2.2-5)   ) to version 8.1.4 cause of security patch just released.

[ raised eyebrow... ]  You're worried about security enough to update
the database, but you're still running an OS release that Red Hat
stopped supporting years ago?  Grab yourself a Fedora download, before
you get hacked into via some other loophole.

My guess as to your specific problem is that the combination of a new
OpenSSL release in /usr/local and an old one in /usr/lib doesn't play
very well --- you're probably picking up some broken combination of new
and old headers and libraries.  You could probably make it work with
enough hacking, but it'd be a lot smarter to spend the effort on an OS
upgrade.

            regards, tom lane