pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedhostnossl in pg_hba.conf demands a password
5+ messages / 3 participants
[nested] [flat]
* hostnossl in pg_hba.conf demands a password
@ 2016-11-14 21:10 John Scalia <jayknowsunix@gmail.com>
0 siblings, 1 reply; 5+ messages in thread
From: John Scalia @ 2016-11-14 21:10 UTC (permalink / raw)
To: pgsql-admin
I've been experimenting a bit with both 9.4.10 and 9.6.0 and both of these are exhibiting the same behavior. I've been setting up zabbix and the local agent requires a trust connection. So, if my pg_hba.conf has a line:
host all monitoring. 127.0.0.1/32. trust
It works as I expected, but if I change "host" to "hostnossl" and reload, it then demands a password for the monitoring user.
The servers are configured with SSL and all other connections require "hostssl", but the zabbix agent is not configured with SSL. I'd say this behavior is a bug, but maybe I missed reading the fine manual somewhere. Has anyone else seen this or maybe the docs need updating.
--
Jay
Sent from my iPad
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: hostnossl in pg_hba.conf demands a password
@ 2016-11-14 21:20 Venkata B Nagothi <nag1010@gmail.com>
parent: John Scalia <jayknowsunix@gmail.com>
0 siblings, 1 reply; 5+ messages in thread
From: Venkata B Nagothi @ 2016-11-14 21:20 UTC (permalink / raw)
To: John Scalia <jayknowsunix@gmail.com>; +Cc: pgsql-admin
On Tue, Nov 15, 2016 at 8:10 AM, John Scalia <jayknowsunix@gmail.com> wrote:
> I've been experimenting a bit with both 9.4.10 and 9.6.0 and both of these
> are exhibiting the same behavior. I've been setting up zabbix and the local
> agent requires a trust connection. So, if my pg_hba.conf has a line:
>
> host all monitoring. 127.0.0.1/32.
> trust
>
> It works as I expected, but if I change "host" to "hostnossl" and reload,
> it then demands a password for the monitoring user.
>
> The servers are configured with SSL and all other connections require
> "hostssl", but the zabbix agent is not configured with SSL. I'd say this
> behavior is a bug, but maybe I missed reading the fine manual somewhere.
> Has anyone else seen this or maybe the docs need updating.
Do you have any other entries (for 127.0.0.1) in pg_hba.conf which is
generating this behaviour ?
Regards,
Venkata B N
Database Consultant
Fujitsu Australia
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: hostnossl in pg_hba.conf demands a password
@ 2016-11-14 21:23 John Scalia <jayknowsunix@gmail.com>
parent: Venkata B Nagothi <nag1010@gmail.com>
0 siblings, 1 reply; 5+ messages in thread
From: John Scalia @ 2016-11-14 21:23 UTC (permalink / raw)
To: Venkata B Nagothi <nag1010@gmail.com>; +Cc: pgsql-admin
The only entries are a local connection line with md5 authentication specified and a line for local replication with a trust authentication. Both of these entries do seem to be working properly.
Sent from my iPad
> On Nov 14, 2016, at 4:20 PM, Venkata B Nagothi <nag1010@gmail.com> wrote:
>
>
>> On Tue, Nov 15, 2016 at 8:10 AM, John Scalia <jayknowsunix@gmail.com> wrote:
>> I've been experimenting a bit with both 9.4.10 and 9.6.0 and both of these are exhibiting the same behavior. I've been setting up zabbix and the local agent requires a trust connection. So, if my pg_hba.conf has a line:
>>
>> host all monitoring. 127.0.0.1/32. trust
>>
>> It works as I expected, but if I change "host" to "hostnossl" and reload, it then demands a password for the monitoring user.
>>
>> The servers are configured with SSL and all other connections require "hostssl", but the zabbix agent is not configured with SSL. I'd say this behavior is a bug, but maybe I missed reading the fine manual somewhere. Has anyone else seen this or maybe the docs need updating.
>
> Do you have any other entries (for 127.0.0.1) in pg_hba.conf which is generating this behaviour ?
>
> Regards,
>
> Venkata B N
> Database Consultant
>
> Fujitsu Australia
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: hostnossl in pg_hba.conf demands a password
@ 2016-11-14 21:52 Tom Lane <tgl@sss.pgh.pa.us>
parent: John Scalia <jayknowsunix@gmail.com>
0 siblings, 1 reply; 5+ messages in thread
From: Tom Lane @ 2016-11-14 21:52 UTC (permalink / raw)
To: John Scalia <jayknowsunix@gmail.com>; +Cc: Venkata B Nagothi <nag1010@gmail.com>; pgsql-admin
John Scalia <jayknowsunix@gmail.com> writes:
> The only entries are a local connection line with md5 authentication specified and a line for local replication with a trust authentication. Both of these entries do seem to be working properly.
So the client is trying an SSL connection first (which would be the
default behavior for libpq at least), and that falls through the
hostnossl line and is captured by the md5 line. Hence you get a
password prompt. The client has no way to know that a non-SSL
connection would have gotten a different response.
You could change the md5 line to hostssl, perhaps. Or configure
the client to try non-SSL first (see sslprefer).
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: hostnossl in pg_hba.conf demands a password
@ 2016-11-14 22:37 John Scalia <jayknowsunix@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 5+ messages in thread
From: John Scalia @ 2016-11-14 22:37 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Venkata B Nagothi <nag1010@gmail.com>; pgsql-admin
Thanks, Tom,
I'll check to see if it's trying an SSL comnection, but being that I logged into this server, and I know that I don't have an .ssh subdirectory in my home dir, I didn't think an SSL connection would be tried. We'll see.
Thanks again,
Jay
Sent from my iPad
> On Nov 14, 2016, at 4:52 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> John Scalia <jayknowsunix@gmail.com> writes:
>> The only entries are a local connection line with md5 authentication specified and a line for local replication with a trust authentication. Both of these entries do seem to be working properly.
>
> So the client is trying an SSL connection first (which would be the
> default behavior for libpq at least), and that falls through the
> hostnossl line and is captured by the md5 line. Hence you get a
> password prompt. The client has no way to know that a non-SSL
> connection would have gotten a different response.
>
> You could change the md5 line to hostssl, perhaps. Or configure
> the client to try non-SSL first (see sslprefer).
>
> regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2016-11-14 22:37 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2016-11-14 21:10 hostnossl in pg_hba.conf demands a password John Scalia <jayknowsunix@gmail.com>
2016-11-14 21:20 ` Venkata B Nagothi <nag1010@gmail.com>
2016-11-14 21:23 ` John Scalia <jayknowsunix@gmail.com>
2016-11-14 21:52 ` Tom Lane <tgl@sss.pgh.pa.us>
2016-11-14 22:37 ` John Scalia <jayknowsunix@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox