pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedSSL problems
7+ messages / 5 participants
[nested] [flat]
* SSL problems
@ 2002-04-11 07:31 Alastair D'Silva <deece@newmillennium.net.au>
0 siblings, 0 replies; 7+ messages in thread
From: Alastair D'Silva @ 2002-04-11 07:31 UTC (permalink / raw)
To: pgsql-admin
I've been busy trying to get Bind9 running smoothly with an SSL
connection to a PostgreSQL database. Running it from one computer
(FreeBSD 4.5-STABLE) across the Internet to the server works fine, but
running Bind9 on the same computer as the server (FreeBSD
4.5-RELEASE-p2) fails, with the error generated from the pq library:
"Could not establish SSL connection: No SSL error reported".
I can telnet to the PostgreSQL port fine, so its not a firewalling
issue, and disabling SSL in postgresql.conf remedies the problem
(although it means my remote connections are no longer encrypted). Yes,
I am aware that I could tunnel the remote connections via SSH, but I'd
rather have the native SSL support.
On a somewhat related note, is it possible to disable SSL for certain ip
address, while enabling it for others? The reason for this is that there
will be some remote and some local TCP connections, and I can see no
reason for encrypting the local TCP connections.
--
Alastair D'Silva B. Sc. mob: 0413 485 733
Networking Consultant
New Millennium Networking http://www.newmillennium.net.au
^ permalink raw reply [nested|flat] 7+ messages in thread
* SSL problems
@ 2008-09-03 12:31 Andriy Bakay <andriy@irbisnet.com>
0 siblings, 0 replies; 7+ messages in thread
From: Andriy Bakay @ 2008-09-03 12:31 UTC (permalink / raw)
To: pgsql-admin; pgsql-ru-general@postgresql.org
Hi Team,
I have problems to setup SSL for PostgreSQL server. I did all the steps
which described in the documentation (17.8. Secure TCP/IP Connections
with SSL), but when I try to start the PostgreSQL server the pg_ctl gave
me: "could not start server". And nothing in the logs (I enabled all of
them). I googled around but did not find much.
My spec:
FreeBSD 7.0-RELEASE-p3 amd64
PostgreSQL 8.3.3 (installed from ports):
WITH_NLS=true
WITHOUT_PAM=true
WITHOUT_LDAP=true
WITHOUT_MIT_KRB5=true
WITHOUT_HEIMDAL_KRB5=true
WITHOUT_OPTIMIZED_CFLAGS=true
WITH_XML=true
WITHOUT_TZDATA=true
WITHOUT_DEBUG=true
WITH_ICU=true
WITH_INTDATE=true
Please help.
Andriy
^ permalink raw reply [nested|flat] 7+ messages in thread
* SSL problems
@ 2008-09-03 12:43 Andriy Bakay <andriy@irbisnet.com>
0 siblings, 2 replies; 7+ messages in thread
From: Andriy Bakay @ 2008-09-03 12:43 UTC (permalink / raw)
To: pgsql-admin; pgsql-ru-general@postgresql.org
Hi Team,
I have problems to setup SSL for PostgreSQL server. I did all the steps
which described in the documentation (17.8. Secure TCP/IP Connections
with SSL), but when I try to start the PostgreSQL server the pg_ctl gave
me: "could not start server". And nothing in the logs (I enabled all of
them). I googled around but did not find much.
My spec:
FreeBSD 7.0-RELEASE-p3 amd64
PostgreSQL 8.3.3 (installed from ports):
WITH_NLS=true
WITHOUT_PAM=true
WITHOUT_LDAP=true
WITHOUT_MIT_KRB5=true
WITHOUT_HEIMDAL_KRB5=true
WITHOUT_OPTIMIZED_CFLAGS=true
WITH_XML=true
WITHOUT_TZDATA=true
WITHOUT_DEBUG=true
WITH_ICU=true
WITH_INTDATE=true
Please help.
Andriy
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: SSL problems
@ 2008-09-03 15:38 Tom Lane <tgl@sss.pgh.pa.us>
parent: Andriy Bakay <andriy@irbisnet.com>
1 sibling, 0 replies; 7+ messages in thread
From: Tom Lane @ 2008-09-03 15:38 UTC (permalink / raw)
To: Andriy Bakay <andriy@irbisnet.com>; +Cc: pgsql-admin; pgsql-ru-general@postgresql.org
Andriy Bakay <andriy@irbisnet.com> writes:
> I have problems to setup SSL for PostgreSQL server. I did all the steps
> which described in the documentation (17.8. Secure TCP/IP Connections
> with SSL), but when I try to start the PostgreSQL server the pg_ctl gave
> me: "could not start server". And nothing in the logs (I enabled all of
> them). I googled around but did not find much.
There is *no* exit path from the PG server that does not spit out an
error message someplace. Re-examine the logging setup. I don't know
how FreeBSD's package sets it up exactly, but there have been packages
in the past that just sent the postmaster's stderr to /dev/null :-(.
See here for some documentation about the settings that determine where
messages go:
http://www.postgresql.org/docs/8.3/static/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHERE
regards, tom lane
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: SSL problems
@ 2008-09-03 19:28 Jan-Peter Seifert <Jan-Peter.Seifert@gmx.de>
parent: Andriy Bakay <andriy@irbisnet.com>
1 sibling, 1 reply; 7+ messages in thread
From: Jan-Peter Seifert @ 2008-09-03 19:28 UTC (permalink / raw)
To: Andriy Bakay <andriy@irbisnet.com>; pgsql-admin
Hello Andriy,
the reply-to settings are a bit uncomfortable here. Your mail went only
to me. But I'm not part of the developer or support team. It's strange
that pg_ctl doesn't say anything else. Is there any system sniffer on
FreeBSD like Process Monitor on Windows? I can only say that the docs
worked for me (removed the password as described) on Ubuntu and Windows.
I got complaints because of the rights on the certificates first. Does
the server really start if SSL is deactivated in postgresql.conf again?
Good luck,
Peter
> Yes of cause I compiled with OpenSSL support (FreeBSD port has this
> option enabled by default). And I have all certificates with proper CA
> signature, rest of applications (Postfix, Apache, etc.) work with this
> certificates very well.
>
> And to make sure I ran the following command 'pg_config':
>
> $ pg_config
> BINDIR = /usr/local/bin
> DOCDIR = /usr/local/share/doc/postgresql
> INCLUDEDIR = /usr/local/include
> PKGINCLUDEDIR = /usr/local/include/postgresql
> INCLUDEDIR-SERVER = /usr/local/include/postgresql/server
> LIBDIR = /usr/local/lib
> PKGLIBDIR = /usr/local/lib/postgresql
> LOCALEDIR = /usr/local/share/locale
> MANDIR = /usr/local/man
> SHAREDIR = /usr/local/share/postgresql
> SYSCONFDIR = /usr/local/etc/postgresql
> PGXS = /usr/local/lib/postgresql/pgxs/src/makefiles/pgxs.mk
> CONFIGURE = '--with-libraries=/usr/local/lib'
> '--with-includes=/usr/local/include' '--enable-thread-safety'
> '--with-docdir=/usr/local/share/doc/postgresql' '--with-openssl'
> '--with-system-tzdata=/usr/share/zoneinfo' '--enable-integer-datetimes'
> '--enable-nls' '--prefix=/usr/local' '--mandir=/usr/local/man'
> '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd7.0' 'CC=cc'
> 'CFLAGS=-O2 -fno-strict-aliasing -pipe ' 'LDFLAGS= -pthread
> -rpath=/usr/local/lib' 'build_alias=amd64-portbld-freebsd7.0'
> CC = cc
> CPPFLAGS = -I/usr/local/include
> CFLAGS = -O2 -fno-strict-aliasing -pipe -Wall -Wmissing-prototypes
> -Wpointer-arith -Winline -Wdeclaration-after-statement -Wendif-labels
> -fno-strict-aliasing -fwrapv
> CFLAGS_SL = -fPIC -DPIC
> LDFLAGS = -pthread -rpath=/usr/local/lib -L/usr/local/lib
> -Wl,-R'/usr/local/lib'
> LDFLAGS_SL =
> LIBS = -lpgport -lintl -lssl -lcrypto -lz -lreadline -lcrypt -lm
> VERSION = PostgreSQL 8.3.3
>
> It should be something else.
>
> Andriy
>
> Jan-Peter.Seifert@gmx.de wrote:
>> Hi,
>>
>>> Datum: Wed, 03 Sep 2008 08:43:29 -0400
>>> Von: Andriy Bakay <andriy@irbisnet.com>
>>> An: pgsql-admin@postgresql.org, pgsql-ru-general@postgresql.org
>>> Betreff: [ADMIN] SSL problems
>>
>>> Hi Team,
>>>
>>> I have problems to setup SSL for PostgreSQL server. I did all the steps
>>> which described in the documentation (17.8. Secure TCP/IP Connections
>>> with SSL), but when I try to start the PostgreSQL server the pg_ctl gave
>>> me: "could not start server". And nothing in the logs (I enabled all of
>>> them). I googled around but did not find much.
>>>
>>> My spec:
>>>
>>> FreeBSD 7.0-RELEASE-p3 amd64
>>>
>>> PostgreSQL 8.3.3 (installed from ports):
>>>
>>> WITH_NLS=true
>>> WITHOUT_PAM=true
>>> WITHOUT_LDAP=true
>>> WITHOUT_MIT_KRB5=true
>>> WITHOUT_HEIMDAL_KRB5=true
>>> WITHOUT_OPTIMIZED_CFLAGS=true
>>> WITH_XML=true
>>> WITHOUT_TZDATA=true
>>> WITHOUT_DEBUG=true
>>> WITH_ICU=true
>>> WITH_INTDATE=true
>>
>> obviously configure hasn't been run with the option "--with-openssl"
>> before compiling the binaries.
>> With the PostgreSQL command pg_config you get the configure options
>> that have been used for making the binaries - so you can make sure. It
>> seems that you must recompile from sources. Are you sure you have
>> openssl itself installed on your system? Maybe you have to generate a
>> certificate as well. It has been a while since I had installed
>> SSL-support successfully on windows and Linux.
>>
>> Peter
>>
>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: SSL problems
@ 2008-09-05 02:01 Andriy Bakay <andriy@irbisnet.com>
parent: Jan-Peter Seifert <Jan-Peter.Seifert@gmx.de>
0 siblings, 1 reply; 7+ messages in thread
From: Andriy Bakay @ 2008-09-05 02:01 UTC (permalink / raw)
To: Jan-Peter Seifert <Jan-Peter.Seifert@gmx.de>; +Cc: pgsql-admin; pgsql-hackers@postgresql.org
After I disable SSL option in postgresql.conf the server is starting
successfully.
Please, advise.
Jan-Peter Seifert wrote:
> Hello Andriy,
>
> the reply-to settings are a bit uncomfortable here. Your mail went only
> to me. But I'm not part of the developer or support team. It's strange
> that pg_ctl doesn't say anything else. Is there any system sniffer on
> FreeBSD like Process Monitor on Windows? I can only say that the docs
> worked for me (removed the password as described) on Ubuntu and Windows.
> I got complaints because of the rights on the certificates first. Does
> the server really start if SSL is deactivated in postgresql.conf again?
>
> Good luck,
>
> Peter
>
>> Yes of cause I compiled with OpenSSL support (FreeBSD port has this
>> option enabled by default). And I have all certificates with proper CA
>> signature, rest of applications (Postfix, Apache, etc.) work with this
>> certificates very well.
>>
>> And to make sure I ran the following command 'pg_config':
>>
>> $ pg_config
>> BINDIR = /usr/local/bin
>> DOCDIR = /usr/local/share/doc/postgresql
>> INCLUDEDIR = /usr/local/include
>> PKGINCLUDEDIR = /usr/local/include/postgresql
>> INCLUDEDIR-SERVER = /usr/local/include/postgresql/server
>> LIBDIR = /usr/local/lib
>> PKGLIBDIR = /usr/local/lib/postgresql
>> LOCALEDIR = /usr/local/share/locale
>> MANDIR = /usr/local/man
>> SHAREDIR = /usr/local/share/postgresql
>> SYSCONFDIR = /usr/local/etc/postgresql
>> PGXS = /usr/local/lib/postgresql/pgxs/src/makefiles/pgxs.mk
>> CONFIGURE = '--with-libraries=/usr/local/lib'
>> '--with-includes=/usr/local/include' '--enable-thread-safety'
>> '--with-docdir=/usr/local/share/doc/postgresql' '--with-openssl'
>> '--with-system-tzdata=/usr/share/zoneinfo' '--enable-integer-datetimes'
>> '--enable-nls' '--prefix=/usr/local' '--mandir=/usr/local/man'
>> '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd7.0' 'CC=cc'
>> 'CFLAGS=-O2 -fno-strict-aliasing -pipe ' 'LDFLAGS= -pthread
>> -rpath=/usr/local/lib' 'build_alias=amd64-portbld-freebsd7.0'
>> CC = cc
>> CPPFLAGS = -I/usr/local/include
>> CFLAGS = -O2 -fno-strict-aliasing -pipe -Wall -Wmissing-prototypes
>> -Wpointer-arith -Winline -Wdeclaration-after-statement -Wendif-labels
>> -fno-strict-aliasing -fwrapv
>> CFLAGS_SL = -fPIC -DPIC
>> LDFLAGS = -pthread -rpath=/usr/local/lib -L/usr/local/lib
>> -Wl,-R'/usr/local/lib'
>> LDFLAGS_SL =
>> LIBS = -lpgport -lintl -lssl -lcrypto -lz -lreadline -lcrypt -lm
>> VERSION = PostgreSQL 8.3.3
>>
>> It should be something else.
>>
>> Andriy
>>
>> Jan-Peter.Seifert@gmx.de wrote:
>>> Hi,
>>>
>>>> Datum: Wed, 03 Sep 2008 08:43:29 -0400
>>>> Von: Andriy Bakay <andriy@irbisnet.com>
>>>> An: pgsql-admin@postgresql.org, pgsql-ru-general@postgresql.org
>>>> Betreff: [ADMIN] SSL problems
>>>> Hi Team,
>>>>
>>>> I have problems to setup SSL for PostgreSQL server. I did all the steps
>>>> which described in the documentation (17.8. Secure TCP/IP Connections
>>>> with SSL), but when I try to start the PostgreSQL server the pg_ctl gave
>>>> me: "could not start server". And nothing in the logs (I enabled all of
>>>> them). I googled around but did not find much.
>>>>
>>>> My spec:
>>>>
>>>> FreeBSD 7.0-RELEASE-p3 amd64
>>>>
>>>> PostgreSQL 8.3.3 (installed from ports):
>>>>
>>>> WITH_NLS=true
>>>> WITHOUT_PAM=true
>>>> WITHOUT_LDAP=true
>>>> WITHOUT_MIT_KRB5=true
>>>> WITHOUT_HEIMDAL_KRB5=true
>>>> WITHOUT_OPTIMIZED_CFLAGS=true
>>>> WITH_XML=true
>>>> WITHOUT_TZDATA=true
>>>> WITHOUT_DEBUG=true
>>>> WITH_ICU=true
>>>> WITH_INTDATE=true
>>> obviously configure hasn't been run with the option "--with-openssl"
>>> before compiling the binaries.
>>> With the PostgreSQL command pg_config you get the configure options
>>> that have been used for making the binaries - so you can make sure. It
>>> seems that you must recompile from sources. Are you sure you have
>>> openssl itself installed on your system? Maybe you have to generate a
>>> certificate as well. It has been a while since I had installed
>>> SSL-support successfully on windows and Linux.
>>>
>>> Peter
>>>
>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: SSL problems
@ 2008-09-05 09:30 Jan-Peter.Seifert@gmx.de
parent: Andriy Bakay <andriy@irbisnet.com>
0 siblings, 0 replies; 7+ messages in thread
From: Jan-Peter.Seifert@gmx.de @ 2008-09-05 09:30 UTC (permalink / raw)
To: pgsql-admin
> Datum: Thu, 04 Sep 2008 22:01:51 -0400
> Von: Andriy Bakay <andriy@irbisnet.com>
> An: Jan-Peter Seifert <Jan-Peter.Seifert@gmx.de>
> CC: pgsql-admin@postgresql.org, pgsql-hackers@postgresql.org
> Betreff: Re: [ADMIN] SSL problems
> After I disable SSL option in postgresql.conf the server is starting
> successfully.
Okay - this was to make sure, that SSL actually really IS the problem. As Tom Lane already mentioned - get your installation to talk to you. pg_ctl should always throw an explaining error message if the server can't be started. In my case with SSL often incorrect privileges on files and/or missing files.
I guess you already have "log_destination = 'stderr'" and "logging_collector = on" enabled in your postgresql.conf ...
If I remember correctly sometimes non-matching versions of PostgreSQL and OpenSSL might be a reason too.
Peter
>
> Please, advise.
>
> Jan-Peter Seifert wrote:
> > Hello Andriy,
> >
> > the reply-to settings are a bit uncomfortable here. Your mail went only
> > to me. But I'm not part of the developer or support team. It's strange
> > that pg_ctl doesn't say anything else. Is there any system sniffer on
> > FreeBSD like Process Monitor on Windows? I can only say that the docs
> > worked for me (removed the password as described) on Ubuntu and Windows.
> > I got complaints because of the rights on the certificates first. Does
> > the server really start if SSL is deactivated in postgresql.conf again?
> >
> > Good luck,
> >
> > Peter
> >
> >> Yes of cause I compiled with OpenSSL support (FreeBSD port has this
> >> option enabled by default). And I have all certificates with proper CA
> >> signature, rest of applications (Postfix, Apache, etc.) work with this
> >> certificates very well.
> >>
> >> And to make sure I ran the following command 'pg_config':
> >>
> >> $ pg_config
> >> BINDIR = /usr/local/bin
> >> DOCDIR = /usr/local/share/doc/postgresql
> >> INCLUDEDIR = /usr/local/include
> >> PKGINCLUDEDIR = /usr/local/include/postgresql
> >> INCLUDEDIR-SERVER = /usr/local/include/postgresql/server
> >> LIBDIR = /usr/local/lib
> >> PKGLIBDIR = /usr/local/lib/postgresql
> >> LOCALEDIR = /usr/local/share/locale
> >> MANDIR = /usr/local/man
> >> SHAREDIR = /usr/local/share/postgresql
> >> SYSCONFDIR = /usr/local/etc/postgresql
> >> PGXS = /usr/local/lib/postgresql/pgxs/src/makefiles/pgxs.mk
> >> CONFIGURE = '--with-libraries=/usr/local/lib'
> >> '--with-includes=/usr/local/include' '--enable-thread-safety'
> >> '--with-docdir=/usr/local/share/doc/postgresql' '--with-openssl'
> >> '--with-system-tzdata=/usr/share/zoneinfo' '--enable-integer-datetimes'
> >> '--enable-nls' '--prefix=/usr/local' '--mandir=/usr/local/man'
> >> '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd7.0' 'CC=cc'
> >> 'CFLAGS=-O2 -fno-strict-aliasing -pipe ' 'LDFLAGS= -pthread
> >> -rpath=/usr/local/lib' 'build_alias=amd64-portbld-freebsd7.0'
> >> CC = cc
> >> CPPFLAGS = -I/usr/local/include
> >> CFLAGS = -O2 -fno-strict-aliasing -pipe -Wall -Wmissing-prototypes
> >> -Wpointer-arith -Winline -Wdeclaration-after-statement -Wendif-labels
> >> -fno-strict-aliasing -fwrapv
> >> CFLAGS_SL = -fPIC -DPIC
> >> LDFLAGS = -pthread -rpath=/usr/local/lib -L/usr/local/lib
> >> -Wl,-R'/usr/local/lib'
> >> LDFLAGS_SL =
> >> LIBS = -lpgport -lintl -lssl -lcrypto -lz -lreadline -lcrypt -lm
> >> VERSION = PostgreSQL 8.3.3
> >>
> >> It should be something else.
> >>
> >> Andriy
> >>
> >> Jan-Peter.Seifert@gmx.de wrote:
> >>> Hi,
> >>>
> >>>> Datum: Wed, 03 Sep 2008 08:43:29 -0400
> >>>> Von: Andriy Bakay <andriy@irbisnet.com>
> >>>> An: pgsql-admin@postgresql.org, pgsql-ru-general@postgresql.org
> >>>> Betreff: [ADMIN] SSL problems
> >>>> Hi Team,
> >>>>
> >>>> I have problems to setup SSL for PostgreSQL server. I did all the
> steps
> >>>> which described in the documentation (17.8. Secure TCP/IP Connections
> >>>> with SSL), but when I try to start the PostgreSQL server the pg_ctl
> gave
> >>>> me: "could not start server". And nothing in the logs (I enabled all
> of
> >>>> them). I googled around but did not find much.
> >>>>
> >>>> My spec:
> >>>>
> >>>> FreeBSD 7.0-RELEASE-p3 amd64
> >>>>
> >>>> PostgreSQL 8.3.3 (installed from ports):
> >>>>
> >>>> WITH_NLS=true
> >>>> WITHOUT_PAM=true
> >>>> WITHOUT_LDAP=true
> >>>> WITHOUT_MIT_KRB5=true
> >>>> WITHOUT_HEIMDAL_KRB5=true
> >>>> WITHOUT_OPTIMIZED_CFLAGS=true
> >>>> WITH_XML=true
> >>>> WITHOUT_TZDATA=true
> >>>> WITHOUT_DEBUG=true
> >>>> WITH_ICU=true
> >>>> WITH_INTDATE=true
> >>> obviously configure hasn't been run with the option "--with-openssl"
> >>> before compiling the binaries.
> >>> With the PostgreSQL command pg_config you get the configure options
> >>> that have been used for making the binaries - so you can make sure. It
> >>> seems that you must recompile from sources. Are you sure you have
> >>> openssl itself installed on your system? Maybe you have to generate a
> >>> certificate as well. It has been a while since I had installed
> >>> SSL-support successfully on windows and Linux.
> >>>
> >>> Peter
> >>>
> >
--
Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2008-09-05 09:30 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2002-04-11 07:31 SSL problems Alastair D'Silva <deece@newmillennium.net.au>
2008-09-03 12:31 SSL problems Andriy Bakay <andriy@irbisnet.com>
2008-09-03 12:43 SSL problems Andriy Bakay <andriy@irbisnet.com>
2008-09-03 15:38 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-09-03 19:28 ` Jan-Peter Seifert <Jan-Peter.Seifert@gmx.de>
2008-09-05 02:01 ` Andriy Bakay <andriy@irbisnet.com>
2008-09-05 09:30 ` Jan-Peter.Seifert@gmx.de
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox