Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1elxvs-00050D-TJ for pgsql-admin@arkaria.postgresql.org; Wed, 14 Feb 2018 14:21:13 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1elxvs-0000lP-05 for pgsql-admin@arkaria.postgresql.org; Wed, 14 Feb 2018 14:21:12 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1elxvr-0000hY-Nr for pgsql-admin@lists.postgresql.org; Wed, 14 Feb 2018 14:21:11 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by magus.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1elxvo-0007HQ-Fb for pgsql-admin@postgresql.org; Wed, 14 Feb 2018 14:21:10 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id C1AE45F79C; Wed, 14 Feb 2018 09:21:06 -0500 (EST) Date: Wed, 14 Feb 2018 09:21:06 -0500 From: Stephen Frost To: Sathesh S Cc: "pgsql-admin@postgresql.org" Subject: Re: Disable /Suppress hostname checks while secured LDAP Message-ID: <20180214142106.GA2416@tamriel.snowman.net> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="QRCgWukCQMlOLh0c" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --QRCgWukCQMlOLh0c Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Sathesh S (sathesh.sundaram@hotmail.com) wrote: > Is there a way to disable/suppress hostname checks in while using Secured= LDAP in postgreSQL for authentication. >=20 > The issue what we have is that the LDAP certificate what we are using is = working for fully qualified named of the domain but not when we use a direc= t LDAP server in the pg_ba.conf file. >=20 > For example: > This works - ldapserver=3D"ldaps//dummy.company.com" >=20 > This doesnt work - ldapserver=3D"server1.dummy.company.com" >=20 > Our internal LDAP team says that we nees to disable/suppress the hostname= checking on the postgreSQL side for the 2nd option to work. >=20 > Does anyone have an idea on how we can suppress hostnames check while usi= ng Secured LDAP. This really isn't recommended because the point of the hostname check is to verify that you're actually talking to the server you intended to. What LDAP server are you using though..? If this is in an Active Directory environment, or any environment where you have Kerberos available, then you should be using Kerberos and *not* using LDAP (or even LDAPS) for authentication as it isn't nearly as secure. Thanks! Stephen --QRCgWukCQMlOLh0c Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJahEXSAAoJEO1sijiDR2RVgoQQAJGxB2ac8qskPmiI9CKZjw+u quWPLbshbBZ3JD26M1TJC7wCqzk9DaT7jnN4qySF16s/QzcJ2oKI3ePgavckHOR2 Hg4hoH+joepNHRtCi4t6tG4jNuPmK7XKEP0iP9+LFRjPFBFKUOB7izrqpdKW3S+g AFNO2n5Ojc7ICFJaF1aq1Q3T4AqUm0IsviTLOZZ9E7tdTNZB90OteRbDcvjnGlMI g5FwtMvoFKI5hBdq4Od2Ta9MGnAimBhgGEXNdRnf5olBeSGP3b1YEOhyki1uGCz3 52y7epJt+R1ar3GfE3fPGJcx4aDjO6kVXaQIygKRZr3l9GM6VPQzYWBQiCQ7l1qU D4qmjQvgiu28r4yxbhBqxxuqrj5m6BBF/Qbj6X5M++Yr4q9d8U3O8o5SRZ4wQJmS muLVb4wZROx2Xihys7ngEHNdEKW3Mq+mQGiPv4fLJuizu7qF+8p4HZyLQPpOUvj6 Y8paaXpubBHdfhBWF1VnpNXXPBJz13Dv/14sw2RrJP0W4tU4YDLnQ0U3R3uwdGzJ 7EuJG2oD1LHTZaVVMhCOQwXFsxzRX33OKPpj4nDIWEcQi4miCd7lMysSXbigYl6k ksRI2VzaSZQdEtZaRv/lLJBPHe1gv9vSgqEGJTqd6gE+t8sUtA0Fi6HlsNy3Xijq 1kHlXocfXJdVjTyXgEtS =xHIb -----END PGP SIGNATURE----- --QRCgWukCQMlOLh0c--