From: | "sergio(dot)cinos(at)info3(dot)com (IMAP)" <sergio(dot)cinos(at)info3(dot)com> |
---|---|
To: | pgsql-admin(at)postgresql(dot)org |
Subject: | Client SSL validation using root.crt |
Date: | 2006-11-17 10:37:37 |
Message-ID: | 298705741.20061117113737@info3.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-admin |
Dear list members,
I see a strange behaviour using root.crt. PostgreSQL always waits a
client certificate to check agains root.crt. But I set up a
'hostnossl' auth line un pg_hba.conf, PostgreSQL still wants a client
certificate. Also fails if line is a 'host'.
Better with an example:
---pg_hba.conf---
hostssl all all 192.168.0.1/32 md5
hostnossl all all 192.168.0.2/32 md5
-----------------
If I connect to PostgresSQL from 192.168.0.1, it fails if I don't
provide a client certificate, it is ok. But if I connect from
192.168.0.2, it also fails becouse I don't send a certificate. But I
declared a non-ssl connection from 192.168.0.2, it should let me
connect to databases, isn'it?
Removing root.crt works as expected. Client in 192.168.0.1 connect
using a SSL connection, and client in 192.168.0.2 connect using a
single connection.
It this behaviour ok? I think not. I want to allow clients on my LAN
access PostgreSQL server without a SSL connection , and require
a client certificate and a SSL connection to clients from outside my LAN.
I think it is not a strange configuration. So the configuration is:
---pg_hba.conf---
hostnossl all all <my-lan-range> md5
hostssl <user> <db> 0.0.0.0/0 md5
-----------------
This fails, because PostgreSQL expect that all clients provide a
client certificate.
Is there any config option to solve this? Is there any page or manual
about PostgreSQL with SSL (more in-deep that
http://www.postgresql.org/docs/8.0/interactive/ssl-tcp.html) ?
Oh, I'm using PostgreSQL 8.0.8 on a Gentoo box. Maybe I have to upgrade
to another version?
Thans you in advance.
--
Sergio Cinos
Info3 Servicios Informáticos S.L.
sergio(dot)cinos(at)info3(dot)com - www.info3.com
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2006-11-17 17:17:42 | Re: Client SSL validation using root.crt |
Previous Message | Kis János Tamás | 2006-11-17 06:52:36 | Re: Postgres at startup |