From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Matthew Lenz <mlenz@nocturnal.org>
To: pgsql-admin@lists.postgresql.org
Subject: Re: proper pg_hba config to require ssl from non-local/private ips
Date: Wed, 19 Oct 2022 17:00:32 +0200
Message-ID: <14560889a3fece7211c94c12b74b524aa5ca86f2.camel@cybertec.at> (raw)
In-Reply-To: <CANpBAJtuxCRnqvixsMFK-D7G=T6T_ma-Xef62saLR8doCW+tRw@mail.gmail.com>
References: <CANpBAJtuxCRnqvixsMFK-D7G=T6T_ma-Xef62saLR8doCW+tRw@mail.gmail.com>
On Wed, 2022-10-19 at 07:49 -0500, Matthew Lenz wrote:
> This is what I've got currently but it's still allowing non-ssl connections from remote (non-local/private) hosts. Any thoughts?
>
> local all all trust
> host all all 127.0.0.1/32 trust
> host all all ::1/128 trust
> host all all 10.0.0.0/8 md5
> host all all 172.16.0.0/12 md5
> hostssl all all all md5 clientcert=verify-ca
>
> Also when I require SSL on the client it allows SSL connections without a CA signed cert
> which I thought clientcert=verify-ca in this pg_hba should require.
Then your client IP address must match the CIDR 172.16.0.0/12, right?
That line matches both unencrypted and encrypted connections, that's why it is used
for SSL connectios as well. To change that, use "hostnossl" in the penultimate line.
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, mlenz@nocturnal.org, pgsql-admin@lists.postgresql.org
Subject: Re: proper pg_hba config to require ssl from non-local/private ips
In-Reply-To: <14560889a3fece7211c94c12b74b524aa5ca86f2.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox