Received: from malur.postgresql.org ([2a02:16a8:dc51::56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fQCkz-0004MQ-So for pgsql-admin@arkaria.postgresql.org; Tue, 05 Jun 2018 14:16:18 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1fQCky-0006OO-Qa for pgsql-admin@arkaria.postgresql.org; Tue, 05 Jun 2018 14:16:16 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fQCky-0006OF-BD for pgsql-admin@lists.postgresql.org; Tue, 05 Jun 2018 14:16:16 +0000 Received: from smtp.kmu4u.ch ([213.221.202.48]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fQCks-0006rn-Uo for pgsql-admin@lists.postgresql.org; Tue, 05 Jun 2018 14:16:13 +0000 X-Virus-Scanned: Debian amavisd-new at smtp.kmu4u.ch X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 required=4 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, NO_RECEIVED=-0.001, NO_RELAYS=-0.001, URIBL_BLOCKED=0.001] autolearn=disabled From: Pierre Ochsenbein To: Jorge Torralba , Johannes Truschnigg CC: "pgsql-admin@lists.postgresql.org" Subject: RE: PostgreSQL Streaming replication on two diff networks Thread-Topic: PostgreSQL Streaming replication on two diff networks Thread-Index: AQHT/M8E+PCURdZG5EaX/+IkgMdSTaRRiisAgAABLoCAAAU7gIAAJE29 Date: Tue, 5 Jun 2018 14:16:05 +0000 Message-ID: <1528208164377.33077@acceleris.ch> References: <1528204459993.51275@acceleris.ch> <20180605134355.omxjwp7rnc5yia6u@vault.lan>, In-Reply-To: Accept-Language: fr-FR, en-US, de-CH Content-Language: fr-FR x-ms-exchange-transport-fromentityheader: Hosted Content-Type: multipart/alternative; boundary="_000_152820816437733077accelerisch_" MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_152820816437733077accelerisch_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Everything is good for the ssh connectivity from the slave to the master bu= t not from the master to the slave. On the master : -bash-4.2$ ssh postgres@10.0.2.67 (slaveIP) Permission denied (publickey,gssapi-keyex,gssapi-with-mic). -bash-4.2$? -bash-4.2$ ssh-copy-id -i id_rsa.pub postgres@10.0.2.67 /bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub" /bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter= out any that are already installed /bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are promp= ted now it is to install the new keys Permission denied (publickey,gssapi-keyex,gssapi-with-mic). -bash-4.2$ -------- On the slave : -bash-4.2$ ssh postgres@10.1.24.13 (masterIP) postgres@10.1.24.13's password: Last failed login: Tue Jun 5 10:10:19 EDT 2018 from slave on ssh:notty There were 44 failed login attempts since the last successful login. Last login: Tue Jun 5 09:48:42 2018 from slave -bash-4.2$ exit logout? ________________________________ De : Jorge Torralba Envoy=E9 : mardi 5 juin 2018 16:02 =C0 : Johannes Truschnigg Cc : Pierre Ochsenbein; pgsql-admin@lists.postgresql.org Objet : Re: PostgreSQL Streaming replication on two diff networks >No; not if there's not even basic IP connectivity between the participatin= g hosts. Pierre will have to make sure he gets the routing between the two si= tes fixed (which is probably going to need some kind of VPN solution).< You are correct. But, I am assuming all routing, vpn's, iptables etc are c= onfigured since it is a known network to the user. He will still need entr= ie in pg_hba.conf. JT On Tue, Jun 5, 2018 at 6:43 AM, Johannes Truschnigg > wrote: On Tue, Jun 05, 2018 at 06:39:42AM -0700, Jorge Torralba wrote: > It's all about the pg_hba.conf :) No; not if there's not even basic IP connectivity between the participating hosts. Pierre will have to make sure he gets the routing between the two si= tes fixed (which is probably going to need some kind of VPN solution). -- with best regards: - Johannes Truschnigg ( johannes@truschnigg.info ) www: https://johannes.truschnigg.info/ phone: +43 650 2 133337 xmpp: johannes@truschnigg.info Please do not bother me with HTML-email or attachments. Thank you. -- Thanks, Jorge Torralba ---------------------------- Note: This communication may contain privileged or other confidential infor= mation. If you are not the intended recipient, please do not print, copy, r= etransmit, disseminate or otherwise use the information. Please indicate to= the sender that you have received this email in error and delete the copy = you received. Thank You. [Acceleris] Acceleris AG | cloudifying IT Pierre Ochsenbein | Technical Consultant Schosshaldenstrasse 85 | CH-3006 Bern T : +41 31 911 33 22 | F : +41 31 911 62 63 pierre.ochsenbein@acceleris.ch | www.acceleris.ch Acceleris Offices are in : Bern | Zurich | Renens | Bucharest [Acceleris] Disclaimer This message possibly contains confidential data or items of information. I= t is intended solely for the rightful recipient. If you should have receive= d the message wrongfully, it is not permitted to disclose the e-mail messag= e or its contents to third parties, to copy or use it. We would respectfull= y request you to destroy the message with the exclusion of any reproduction= and to notify this to the originator by e-mail. Thank you very much. --_000_152820816437733077accelerisch_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Everything is good for th= e ssh connectivity f= rom the slave to the master but not from the master to the slave.


On the master = :

-bash-4.2$ ssh= postgres@10.0.2.67 (slaveIP)

Permis= sion denied (publickey,gssapi-keyex,gssapi-with-mic).

-bash-4.2$​


-bash-4.2$ ssh-copy-id -i id_rsa.pub postgres@10.0.2.67
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub&= quot;
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter= out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are promp= ted now it is to install the new keys
Permission denied (publickey,gssapi-keyex,gssapi-with-mic)= .
-bash-4.2$


--------


On the slave : 

-bash-4.2$ ssh= postgres@10.1.24.13 (masterIP)

postgres@10.1.= 24.13's password: 

Last failed lo= gin: Tue Jun  5 10:1= 0:19 EDT 2018 from slave<= span class=3D"Apple-converted-space"> on ssh:notty

There were 44 = failed login attempts since the last successful login.

Last login: Tu= e Jun  5 09:48:42 20= 18 from slave

-bash-4.2$ exi= t

logout​<= /span>



De : Jorge Torralba <j= orge.torralba@gmail.com>
Envoy=E9 : mardi 5 juin 2018 16:02
=C0 : Johannes Truschnigg
Cc : Pierre Ochsenbein; pgsql-admin@lists.postgresql.org
Objet : Re: PostgreSQL Streaming replication on two diff networks
 
>No; not if there's not even basic IP connectivity between the participating
= hosts. Pierre will have to make sure he gets the routing between the two sites
= fixed (which is probably going to need some kind of VPN solution).<

You are correct. But,  I am assuming all routing, vpn's, iptables= etc are configured since it is a known network to the user.  He will = still need entrie in pg_hba.conf.

JT

On Tue, Jun 5, 2018 at 6:43 AM, Johannes Truschn= igg <johannes@= truschnigg.info> wrote:
On Tue, Jun 05, 2018 at 06:39:42AM -0700, Jorge Torralba w= rote:
> It's all about the pg_hba.conf :)

No; not if there's not even basic IP connectivity between the partic= ipating
hosts. Pierre will have to make sure he gets the routing between the two si= tes
fixed (which is probably going to need some kind of VPN solution).

--
with best regards:
- Johannes Truschnigg ( johanne= s@truschnigg.info )

www:   https://johannes.truschnigg.info/
phone: +43 650 2 133337
xmpp:  johannes@truschnigg= .info

Please do not bother me with HTML-email or attachments. Thank you.



--
Thanks,

Jorge Torralba
----------------------------

Note: This communication may contain privileged or other confidential infor= mation. If you are not the intended recipient, please do not print, copy, r= etransmit, disseminate or otherwise use the information. Please indicate to= the sender that you have received this email in error and delete the copy you received. Thank You.

3D"Acceleris"

Accele= ris AG | cloudifying IT
Pierre Ochsenbein | Technical Consultant
Schosshaldenstrasse 85 | CH-3006 Bern
T : +41 31 911 33 22 | F : +41 31 911 62 63
pierre.ochsenbein@acceleris.ch | www.acceleris.ch  

Acceleris Offices are in :
Bern | Zurich | Renens | Bucharest
 
3D"Acceleris"
 

Disclaimer

This message possibly contains confidential data or items of information. I= t is intended solely for the rightful recipient. If you should have receive= d the message wrongfully, it is not permitted to disclose the e-mail messag= e or its contents to third parties, to copy or use it. We would respectfully request you to destroy the messag= e with the exclusion of any reproduction and to notify this to the originat= or by e-mail. Thank you very much.





--_000_152820816437733077accelerisch_--