From: Stephen Frost <sfrost@snowman.net>
To: Raj kumar <rajkumar820999@gmail.com>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: GSSAPI encryption support
Date: Mon, 18 May 2020 11:40:22 -0400
Message-ID: <20200518154022.GZ13712@tamriel.snowman.net> (raw)
In-Reply-To: <CACxU--VTrpP9=J4w_dQb+PiucK=KQVKSg13tOxLJFavr8X67kA@mail.gmail.com>
References: <CACxU--VTrpP9=J4w_dQb+PiucK=KQVKSg13tOxLJFavr8X67kA@mail.gmail.com>
Greetings,
* Raj kumar (rajkumar820999@gmail.com) wrote:
> 1) The encryption support means that the encryption between the Client and
> the Server over the network, which was previously possible only through SSL
> or previously, not encrypted at all. Now, instead of SSL, we can change
> pg_hba.conf with the parameters "hostgssenc" and hostnogssenc" to support
> encryption over the network directly using gssapi.
Yes.
> 2) We need to have a client server, a service server and a Key Distribution
> Center Server which should have Kerberose installed in it. Kerberose is
> available as opensource.
Not sure what you mean by 'client server' and 'service server' here,
but, yes you do need a client, a PG server, and a KDC. There's multiple
Kerberos implementations available as open source- MIT Kerberos and
Heimdal are the popular ones.
> Please help me if my understanding is correct and let me know about the
> major improvement on this feature with PG12. I have referred Documentation
> and some blogs. But, couldn't get the right picture. Your reply is
> appreciable.
As usual, you'll want to run the most recent minor version of PG,
particularly when working with new features. We've had a few issues in
the GSSAPI encryption which have been fixed in the latest PG12 minor
release (12.3).
Generally speaking, if you've got a Kerberos environment and have PG
working with Kerberos, GSSAPI encryption will just start happening,
though it is recommended to use the 'hostgssenc' lines on the server
side pg_hba.conf, as you mention, and on the client side set
'gssencmode=require' on the client, to ensure the communication will
be using GSSAPI encryption (the default is only 'prefer', similar to
SSL).
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, rajkumar820999@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: GSSAPI encryption support
In-Reply-To: <20200518154022.GZ13712@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox