pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedGSSAPI encryption support
4+ messages / 2 participants
[nested] [flat]
* GSSAPI encryption support
@ 2020-05-18 11:49 Raj kumar <rajkumar820999@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Raj kumar @ 2020-05-18 11:49 UTC (permalink / raw)
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Hi Team,
Postgres 12 added "GSSAPI encryption support" as an additional feature to
"GSSAPI Authentication" mechanism introduced in Postgres 11. I have few
questions based on it.
1) The encryption support means that the encryption between the Client and
the Server over the network, which was previously possible only through SSL
or previously, not encrypted at all. Now, instead of SSL, we can change
pg_hba.conf with the parameters "hostgssenc" and hostnogssenc" to support
encryption over the network directly using gssapi.
2) We need to have a client server, a service server and a Key Distribution
Center Server which should have Kerberose installed in it. Kerberose is
available as opensource.
Please help me if my understanding is correct and let me know about the
major improvement on this feature with PG12. I have referred Documentation
and some blogs. But, couldn't get the right picture. Your reply is
appreciable.
Thanks and Regards,
Raj Kumar.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: GSSAPI encryption support
@ 2020-05-18 15:40 Stephen Frost <sfrost@snowman.net>
parent: Raj kumar <rajkumar820999@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Stephen Frost @ 2020-05-18 15:40 UTC (permalink / raw)
To: Raj kumar <rajkumar820999@gmail.com>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Greetings,
* Raj kumar (rajkumar820999@gmail.com) wrote:
> 1) The encryption support means that the encryption between the Client and
> the Server over the network, which was previously possible only through SSL
> or previously, not encrypted at all. Now, instead of SSL, we can change
> pg_hba.conf with the parameters "hostgssenc" and hostnogssenc" to support
> encryption over the network directly using gssapi.
Yes.
> 2) We need to have a client server, a service server and a Key Distribution
> Center Server which should have Kerberose installed in it. Kerberose is
> available as opensource.
Not sure what you mean by 'client server' and 'service server' here,
but, yes you do need a client, a PG server, and a KDC. There's multiple
Kerberos implementations available as open source- MIT Kerberos and
Heimdal are the popular ones.
> Please help me if my understanding is correct and let me know about the
> major improvement on this feature with PG12. I have referred Documentation
> and some blogs. But, couldn't get the right picture. Your reply is
> appreciable.
As usual, you'll want to run the most recent minor version of PG,
particularly when working with new features. We've had a few issues in
the GSSAPI encryption which have been fixed in the latest PG12 minor
release (12.3).
Generally speaking, if you've got a Kerberos environment and have PG
working with Kerberos, GSSAPI encryption will just start happening,
though it is recommended to use the 'hostgssenc' lines on the server
side pg_hba.conf, as you mention, and on the client side set
'gssencmode=require' on the client, to ensure the communication will
be using GSSAPI encryption (the default is only 'prefer', similar to
SSL).
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: GSSAPI encryption support
@ 2020-05-19 04:55 Raj kumar <rajkumar820999@gmail.com>
parent: Stephen Frost <sfrost@snowman.net>
0 siblings, 1 reply; 4+ messages in thread
From: Raj kumar @ 2020-05-19 04:55 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Thanks Stephen. 😊
Thanks,
Raj
On Mon, 18 May 2020, 21:10 Stephen Frost, <sfrost@snowman.net> wrote:
> Greetings,
>
> * Raj kumar (rajkumar820999@gmail.com) wrote:
> > 1) The encryption support means that the encryption between the Client
> and
> > the Server over the network, which was previously possible only through
> SSL
> > or previously, not encrypted at all. Now, instead of SSL, we can change
> > pg_hba.conf with the parameters "hostgssenc" and hostnogssenc" to support
> > encryption over the network directly using gssapi.
>
> Yes.
>
> > 2) We need to have a client server, a service server and a Key
> Distribution
> > Center Server which should have Kerberose installed in it. Kerberose is
> > available as opensource.
>
> Not sure what you mean by 'client server' and 'service server' here,
> but, yes you do need a client, a PG server, and a KDC. There's multiple
> Kerberos implementations available as open source- MIT Kerberos and
> Heimdal are the popular ones.
>
> > Please help me if my understanding is correct and let me know about the
> > major improvement on this feature with PG12. I have referred
> Documentation
> > and some blogs. But, couldn't get the right picture. Your reply is
> > appreciable.
>
> As usual, you'll want to run the most recent minor version of PG,
> particularly when working with new features. We've had a few issues in
> the GSSAPI encryption which have been fixed in the latest PG12 minor
> release (12.3).
>
> Generally speaking, if you've got a Kerberos environment and have PG
> working with Kerberos, GSSAPI encryption will just start happening,
> though it is recommended to use the 'hostgssenc' lines on the server
> side pg_hba.conf, as you mention, and on the client side set
> 'gssencmode=require' on the client, to ensure the communication will
> be using GSSAPI encryption (the default is only 'prefer', similar to
> SSL).
>
> Thanks,
>
> Stephen
>
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: GSSAPI encryption support
@ 2020-05-19 13:33 Stephen Frost <sfrost@snowman.net>
parent: Raj kumar <rajkumar820999@gmail.com>
0 siblings, 0 replies; 4+ messages in thread
From: Stephen Frost @ 2020-05-19 13:33 UTC (permalink / raw)
To: Raj kumar <rajkumar820999@gmail.com>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Greetings,
* Raj kumar (rajkumar820999@gmail.com) wrote:
> Thanks Stephen. 😊
Sure. Also- just to be clear, if you already have an Active Directory
environment, then you already have a KDC- you don't need to stand up
another one (though you certainly could and could use a cross-realm
trust relationship between the AD environment to the MIT/Heimdal one, if
you wanted, and allow AD authenticated users to connect to the PG server
in the MIT/Heimdal realm using Kerberos).
Thanks,
Stephen
> On Mon, 18 May 2020, 21:10 Stephen Frost, <sfrost@snowman.net> wrote:
>
> > Greetings,
> >
> > * Raj kumar (rajkumar820999@gmail.com) wrote:
> > > 1) The encryption support means that the encryption between the Client
> > and
> > > the Server over the network, which was previously possible only through
> > SSL
> > > or previously, not encrypted at all. Now, instead of SSL, we can change
> > > pg_hba.conf with the parameters "hostgssenc" and hostnogssenc" to support
> > > encryption over the network directly using gssapi.
> >
> > Yes.
> >
> > > 2) We need to have a client server, a service server and a Key
> > Distribution
> > > Center Server which should have Kerberose installed in it. Kerberose is
> > > available as opensource.
> >
> > Not sure what you mean by 'client server' and 'service server' here,
> > but, yes you do need a client, a PG server, and a KDC. There's multiple
> > Kerberos implementations available as open source- MIT Kerberos and
> > Heimdal are the popular ones.
> >
> > > Please help me if my understanding is correct and let me know about the
> > > major improvement on this feature with PG12. I have referred
> > Documentation
> > > and some blogs. But, couldn't get the right picture. Your reply is
> > > appreciable.
> >
> > As usual, you'll want to run the most recent minor version of PG,
> > particularly when working with new features. We've had a few issues in
> > the GSSAPI encryption which have been fixed in the latest PG12 minor
> > release (12.3).
> >
> > Generally speaking, if you've got a Kerberos environment and have PG
> > working with Kerberos, GSSAPI encryption will just start happening,
> > though it is recommended to use the 'hostgssenc' lines on the server
> > side pg_hba.conf, as you mention, and on the client side set
> > 'gssencmode=require' on the client, to ensure the communication will
> > be using GSSAPI encryption (the default is only 'prefer', similar to
> > SSL).
> >
> > Thanks,
> >
> > Stephen
> >
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2020-05-19 13:33 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-05-18 11:49 GSSAPI encryption support Raj kumar <rajkumar820999@gmail.com>
2020-05-18 15:40 ` Stephen Frost <sfrost@snowman.net>
2020-05-19 04:55 ` Raj kumar <rajkumar820999@gmail.com>
2020-05-19 13:33 ` Stephen Frost <sfrost@snowman.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox