Date: Mon, 18 May 2020 11:40:22 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Raj kumar <rajkumar820999@gmail.com>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: GSSAPI encryption support
Message-ID: <20200518154022.GZ13712@tamriel.snowman.net>
References: 
 <CACxU--VTrpP9=J4w_dQb+PiucK=KQVKSg13tOxLJFavr8X67kA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="qovKwPEBYRZY5n08"
Content-Disposition: inline
In-Reply-To: 
 <CACxU--VTrpP9=J4w_dQb+PiucK=KQVKSg13tOxLJFavr8X67kA@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--qovKwPEBYRZY5n08
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

* Raj kumar (rajkumar820999@gmail.com) wrote:
> 1) The encryption support means that the encryption between the Client and
> the Server over the network, which was previously possible only through SSL
> or previously, not encrypted at all. Now, instead of SSL, we can change
> pg_hba.conf with the parameters "hostgssenc" and hostnogssenc" to support
> encryption over the network directly using gssapi.

Yes.

> 2) We need to have a client server, a service server and a Key Distribution
> Center Server which should have Kerberose installed in it. Kerberose is
> available as opensource.

Not sure what you mean by 'client server' and 'service server' here,
but, yes you do need a client, a PG server, and a KDC.  There's multiple
Kerberos implementations available as open source- MIT Kerberos and
Heimdal are the popular ones.

> Please help me if my understanding is correct and let me know about the
> major improvement on this feature with PG12. I have referred Documentation
> and some blogs. But, couldn't get the right picture. Your reply is
> appreciable.

As usual, you'll want to run the most recent minor version of PG,
particularly when working with new features.  We've had a few issues in
the GSSAPI encryption which have been fixed in the latest PG12 minor
release (12.3).

Generally speaking, if you've got a Kerberos environment and have PG
working with Kerberos, GSSAPI encryption will just start happening,
though it is recommended to use the 'hostgssenc' lines on the server
side pg_hba.conf, as you mention, and on the client side set
'gssencmode=require' on the client, to ensure the communication will
be using GSSAPI encryption (the default is only 'prefer', similar to
SSL).

Thanks,

Stephen

--qovKwPEBYRZY5n08
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJewqxmAAoJEO1sijiDR2RV16QQAJ3t7pkrfTV5btCT11a9v2qQ
CKSsdy4lt2oaFjpDVqrXE3gbCkNjcH8clhnnyuQ7E8r0lrFqBnkA2bi9olV69fjB
BZu4WZgukE5xyAFylte9lC6YkM8GmixmXb3TU4LsOSJugHaKwiZib+Yu6/FrPqmg
I3bQNts8pxJZkVNRWvzpMEHAGzWV8Izk8Y4xNZWE/WgWVNoFNIajlsn36CnX0JVj
xBmqs4SSdjVSS15mmWv3JaEwoWhw4wf5cAE6cW6C5KAkW9wByfF1YBTk2hgjOTUK
I4dSLzeYmxFR8G6v5B4pZmGuD+/TmpjtaFNkgACmhixbEnl9cQFfhyEinMMbxqaM
5sLXDH506xJf3dCMlAH/BFh+njaK4GWc7EGvp/NsYQEGv8t1CP44yARLw58DDcms
2uVb9VnmW5LDgFkxxVnIhKY1IcJpPD3i7C6DloP7Htu3qJfw99SF8y8CRVYKjggp
kbcGPvVXe8FkMrWvP7LUd7wcgp9iQt+iS+16m7ZpFjPYBXHwyfF4XqpQr2834Z2o
2SlMe4oZZe8raw/dOUw8uam+H5mDDGiGyKO5EhFDxLH7GeLCTnKUHJ6PZUJF8JWJ
q9DD3Q9Zcsh+gzQV28UV0gZ/sQysF1gGYTv15X9jGuoEo+4B9S/yW5uB41vbnqKt
FUT/FS7J0hNE8yauKBPS
=3OuE
-----END PGP SIGNATURE-----

--qovKwPEBYRZY5n08--