pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedDisable /Suppress hostname checks while secured LDAP
6+ messages / 3 participants
[nested] [flat]
* Disable /Suppress hostname checks while secured LDAP
@ 2018-02-14 06:57 Sathesh S <sathesh.sundaram@hotmail.com>
2018-02-14 07:22 ` Re: Disable /Suppress hostname checks while secured LDAP Pavan Teja <pavan.postgresdba@gmail.com>
2018-02-14 14:21 ` Re: Disable /Suppress hostname checks while secured LDAP Stephen Frost <sfrost@snowman.net>
0 siblings, 2 replies; 6+ messages in thread
From: Sathesh S @ 2018-02-14 06:57 UTC (permalink / raw)
To: pgsql-admin
Hello All,
Is there a way to disable/suppress hostname checks in while using Secured LDAP in postgreSQL for authentication.
The issue what we have is that the LDAP certificate what we are using is working for fully qualified named of the domain but not when we use a direct LDAP server in the pg_ba.conf file.
For example:
This works - ldapserver="ldaps//dummy.company.com"
This doesnt work - ldapserver="server1.dummy.company.com"
Our internal LDAP team says that we nees to disable/suppress the hostname checking on the postgreSQL side for the 2nd option to work.
Does anyone have an idea on how we can suppress hostnames check while using Secured LDAP.
Thanks ,
Sathesh
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Disable /Suppress hostname checks while secured LDAP
2018-02-14 06:57 Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
@ 2018-02-14 07:22 ` Pavan Teja <pavan.postgresdba@gmail.com>
2018-02-14 07:41 ` Re: Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
1 sibling, 1 reply; 6+ messages in thread
From: Pavan Teja @ 2018-02-14 07:22 UTC (permalink / raw)
To: Sathesh S <sathesh.sundaram@hotmail.com>; +Cc: pgsql-admin
Hi satheesh,
Instead of ldap authentication method you can also use other methods like
md5, and if it's trusted server u can use trust authentication method etc.
Please refer the documentation regarding different authentication methods
in pg_hba.conf file
On Feb 14, 2018 12:27 PM, "Sathesh S" <sathesh.sundaram@hotmail.com> wrote:
> Hello All,
>
> Is there a way to disable/suppress hostname checks in while using Secured
> LDAP in postgreSQL for authentication.
>
> The issue what we have is that the LDAP certificate what we are using is
> working for fully qualified named of the domain but not when we use a
> direct LDAP server in the pg_ba.conf file.
>
> For example:
> This works - ldapserver="ldaps//dummy.company.com"
>
> This doesnt work - ldapserver="server1.dummy.company.com"
>
> Our internal LDAP team says that we nees to disable/suppress the hostname
> checking on the postgreSQL side for the 2nd option to work.
>
> Does anyone have an idea on how we can suppress hostnames check while
> using Secured LDAP.
>
> Thanks ,
> Sathesh
>
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Disable /Suppress hostname checks while secured LDAP
2018-02-14 06:57 Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
2018-02-14 07:22 ` Re: Disable /Suppress hostname checks while secured LDAP Pavan Teja <pavan.postgresdba@gmail.com>
@ 2018-02-14 07:41 ` Sathesh S <sathesh.sundaram@hotmail.com>
0 siblings, 0 replies; 6+ messages in thread
From: Sathesh S @ 2018-02-14 07:41 UTC (permalink / raw)
To: Pavan Teja <pavan.postgresdba@gmail.com>; +Cc: pgsql-admin
Hi Pavan,
We have to use LDAP to comply with our standards. Any suggestions on suppressing hostname check would be helpful.
Thanks,
Sathesh
________________________________
From: Pavan Teja <pavan.postgresdba@gmail.com>
Sent: Wednesday, February 14, 2018 12:52:10 PM
To: Sathesh S
Cc: pgsql-admin@postgresql.org
Subject: Re: Disable /Suppress hostname checks while secured LDAP
Hi satheesh,
Instead of ldap authentication method you can also use other methods like md5, and if it's trusted server u can use trust authentication method etc. Please refer the documentation regarding different authentication methods in pg_hba.conf file
On Feb 14, 2018 12:27 PM, "Sathesh S" <sathesh.sundaram@hotmail.com<mailto:sathesh.sundaram@hotmail.com>> wrote:
Hello All,
Is there a way to disable/suppress hostname checks in while using Secured LDAP in postgreSQL for authentication.
The issue what we have is that the LDAP certificate what we are using is working for fully qualified named of the domain but not when we use a direct LDAP server in the pg_ba.conf file.
For example:
This works - ldapserver="ldaps//dummy.company.com<http://dummy.company.com>";
This doesnt work - ldapserver="server1.dummy.company.com<http://server1.dummy.company.com>";
Our internal LDAP team says that we nees to disable/suppress the hostname checking on the postgreSQL side for the 2nd option to work.
Does anyone have an idea on how we can suppress hostnames check while using Secured LDAP.
Thanks ,
Sathesh
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Disable /Suppress hostname checks while secured LDAP
2018-02-14 06:57 Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
@ 2018-02-14 14:21 ` Stephen Frost <sfrost@snowman.net>
2018-02-17 02:52 ` Re: Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
1 sibling, 1 reply; 6+ messages in thread
From: Stephen Frost @ 2018-02-14 14:21 UTC (permalink / raw)
To: Sathesh S <sathesh.sundaram@hotmail.com>; +Cc: pgsql-admin
Greetings,
* Sathesh S (sathesh.sundaram@hotmail.com) wrote:
> Is there a way to disable/suppress hostname checks in while using Secured LDAP in postgreSQL for authentication.
>
> The issue what we have is that the LDAP certificate what we are using is working for fully qualified named of the domain but not when we use a direct LDAP server in the pg_ba.conf file.
>
> For example:
> This works - ldapserver="ldaps//dummy.company.com"
>
> This doesnt work - ldapserver="server1.dummy.company.com"
>
> Our internal LDAP team says that we nees to disable/suppress the hostname checking on the postgreSQL side for the 2nd option to work.
>
> Does anyone have an idea on how we can suppress hostnames check while using Secured LDAP.
This really isn't recommended because the point of the hostname check is
to verify that you're actually talking to the server you intended to.
What LDAP server are you using though..? If this is in an Active
Directory environment, or any environment where you have Kerberos
available, then you should be using Kerberos and *not* using LDAP (or
even LDAPS) for authentication as it isn't nearly as secure.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Disable /Suppress hostname checks while secured LDAP
2018-02-14 06:57 Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
2018-02-14 14:21 ` Re: Disable /Suppress hostname checks while secured LDAP Stephen Frost <sfrost@snowman.net>
@ 2018-02-17 02:52 ` Sathesh S <sathesh.sundaram@hotmail.com>
2018-02-20 13:52 ` Re: Disable /Suppress hostname checks while secured LDAP Stephen Frost <sfrost@snowman.net>
0 siblings, 1 reply; 6+ messages in thread
From: Sathesh S @ 2018-02-17 02:52 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: pgsql-admin
Thanks for the input Stephen, we are using active directory.
- Sathesh
________________________________
From: Stephen Frost <sfrost@snowman.net>
Sent: Wednesday, February 14, 2018 7:51:06 PM
To: Sathesh S
Cc: pgsql-admin@postgresql.org
Subject: Re: Disable /Suppress hostname checks while secured LDAP
Greetings,
* Sathesh S (sathesh.sundaram@hotmail.com) wrote:
> Is there a way to disable/suppress hostname checks in while using Secured LDAP in postgreSQL for authentication.
>
> The issue what we have is that the LDAP certificate what we are using is working for fully qualified named of the domain but not when we use a direct LDAP server in the pg_ba.conf file.
>
> For example:
> This works - ldapserver="ldaps//dummy.company.com"
>
> This doesnt work - ldapserver="server1.dummy.company.com"
>
> Our internal LDAP team says that we nees to disable/suppress the hostname checking on the postgreSQL side for the 2nd option to work.
>
> Does anyone have an idea on how we can suppress hostnames check while using Secured LDAP.
This really isn't recommended because the point of the hostname check is
to verify that you're actually talking to the server you intended to.
What LDAP server are you using though..? If this is in an Active
Directory environment, or any environment where you have Kerberos
available, then you should be using Kerberos and *not* using LDAP (or
even LDAPS) for authentication as it isn't nearly as secure.
Thanks!
Stephen
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Disable /Suppress hostname checks while secured LDAP
2018-02-14 06:57 Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
2018-02-14 14:21 ` Re: Disable /Suppress hostname checks while secured LDAP Stephen Frost <sfrost@snowman.net>
2018-02-17 02:52 ` Re: Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
@ 2018-02-20 13:52 ` Stephen Frost <sfrost@snowman.net>
0 siblings, 0 replies; 6+ messages in thread
From: Stephen Frost @ 2018-02-20 13:52 UTC (permalink / raw)
To: Sathesh S <sathesh.sundaram@hotmail.com>; +Cc: pgsql-admin
Greetings Sathesh,
* Sathesh S (sathesh.sundaram@hotmail.com) wrote:
> Thanks for the input Stephen, we are using active directory.
You should definitely be using Kerberos then and *not* LDAP for
authentication in an Active Directory environment.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2018-02-20 13:52 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2018-02-14 06:57 Disable /Suppress hostname checks while secured LDAP Sathesh S <sathesh.sundaram@hotmail.com>
2018-02-14 07:22 ` Pavan Teja <pavan.postgresdba@gmail.com>
2018-02-14 07:41 ` Sathesh S <sathesh.sundaram@hotmail.com>
2018-02-14 14:21 ` Stephen Frost <sfrost@snowman.net>
2018-02-17 02:52 ` Sathesh S <sathesh.sundaram@hotmail.com>
2018-02-20 13:52 ` Stephen Frost <sfrost@snowman.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox