Message-ID: <14560889a3fece7211c94c12b74b524aa5ca86f2.camel@cybertec.at>
Subject: Re: proper pg_hba config to require ssl from non-local/private ips
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Matthew Lenz <mlenz@nocturnal.org>, pgsql-admin@lists.postgresql.org
Date: Wed, 19 Oct 2022 17:00:32 +0200
In-Reply-To: 
 <CANpBAJtuxCRnqvixsMFK-D7G=T6T_ma-Xef62saLR8doCW+tRw@mail.gmail.com>
References: 
	<CANpBAJtuxCRnqvixsMFK-D7G=T6T_ma-Xef62saLR8doCW+tRw@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.42.4 (3.42.4-2.fc35) 
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Archived-At: 
 <https://www.postgresql.org/message-id/14560889a3fece7211c94c12b74b524aa5ca86f2.camel%40cybertec.at>
Precedence: bulk

On Wed, 2022-10-19 at 07:49 -0500, Matthew Lenz wrote:
> This is what I've got currently but it's still allowing non-ssl connections from remote (non-local/private) hosts. Any thoughts?
> 
> local   all             all                                     trust
> host    all             all             127.0.0.1/32            trust
> host    all             all             ::1/128                 trust
> host    all             all             10.0.0.0/8              md5
> host    all             all             172.16.0.0/12           md5
> hostssl all             all             all                     md5 clientcert=verify-ca
> 
> Also when I require SSL on the client it allows SSL connections without a CA signed cert
> which I thought clientcert=verify-ca in this pg_hba should require.

Then your client IP address must match the CIDR 172.16.0.0/12, right?

That line matches both unencrypted and encrypted connections, that's why it is used
for SSL connectios as well.  To change that, use "hostnossl" in the penultimate line.

Yours,
Laurenz Albe
-- 
Cybertec | https://www.cybertec-postgresql.com