Date: Tue, 19 May 2020 09:33:10 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Raj kumar <rajkumar820999@gmail.com>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: GSSAPI encryption support
Message-ID: <20200519133309.GJ13712@tamriel.snowman.net>
References: 
 <CACxU--VTrpP9=J4w_dQb+PiucK=KQVKSg13tOxLJFavr8X67kA@mail.gmail.com>
 <20200518154022.GZ13712@tamriel.snowman.net>
 <CACxU--WutUdmVaR3_X5e1FXHgXrZwbecT8j0BZD_M1cQ4KbG2A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="uFCT/mKo947wgAms"
Content-Disposition: inline
In-Reply-To: 
 <CACxU--WutUdmVaR3_X5e1FXHgXrZwbecT8j0BZD_M1cQ4KbG2A@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--uFCT/mKo947wgAms
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Raj kumar (rajkumar820999@gmail.com) wrote:
> Thanks Stephen. =F0=9F=98=8A

Sure.  Also- just to be clear, if you already have an Active Directory
environment, then you already have a KDC- you don't need to stand up
another one (though you certainly could and could use a cross-realm
trust relationship between the AD environment to the MIT/Heimdal one, if
you wanted, and allow AD authenticated users to connect to the PG server
in the MIT/Heimdal realm using Kerberos).

Thanks,

Stephen

> On Mon, 18 May 2020, 21:10 Stephen Frost, <sfrost@snowman.net> wrote:
>=20
> > Greetings,
> >
> > * Raj kumar (rajkumar820999@gmail.com) wrote:
> > > 1) The encryption support means that the encryption between the Client
> > and
> > > the Server over the network, which was previously possible only throu=
gh
> > SSL
> > > or previously, not encrypted at all. Now, instead of SSL, we can chan=
ge
> > > pg_hba.conf with the parameters "hostgssenc" and hostnogssenc" to sup=
port
> > > encryption over the network directly using gssapi.
> >
> > Yes.
> >
> > > 2) We need to have a client server, a service server and a Key
> > Distribution
> > > Center Server which should have Kerberose installed in it. Kerberose =
is
> > > available as opensource.
> >
> > Not sure what you mean by 'client server' and 'service server' here,
> > but, yes you do need a client, a PG server, and a KDC.  There's multiple
> > Kerberos implementations available as open source- MIT Kerberos and
> > Heimdal are the popular ones.
> >
> > > Please help me if my understanding is correct and let me know about t=
he
> > > major improvement on this feature with PG12. I have referred
> > Documentation
> > > and some blogs. But, couldn't get the right picture. Your reply is
> > > appreciable.
> >
> > As usual, you'll want to run the most recent minor version of PG,
> > particularly when working with new features.  We've had a few issues in
> > the GSSAPI encryption which have been fixed in the latest PG12 minor
> > release (12.3).
> >
> > Generally speaking, if you've got a Kerberos environment and have PG
> > working with Kerberos, GSSAPI encryption will just start happening,
> > though it is recommended to use the 'hostgssenc' lines on the server
> > side pg_hba.conf, as you mention, and on the client side set
> > 'gssencmode=3Drequire' on the client, to ensure the communication will
> > be using GSSAPI encryption (the default is only 'prefer', similar to
> > SSL).
> >
> > Thanks,
> >
> > Stephen
> >

--uFCT/mKo947wgAms
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJew+AVAAoJEO1sijiDR2RVKEAP/R12SyXup09f7Tmb2150m67i
50yvpfUeTKt2uJTWzDiqSyEtZsOHrBEQjYf/qBUv1B8s3FtJM+7Q3D+0Jj3StUdB
+O2VzTZLjUa0OPtTBJzZp9/BcgHKR9CDLsxFID56dIkKCDdbToO9yEpxTQc3Szz4
tjQmhVFF88kp4rpz3ZOd7eA+LmkaYXXhRvgh303G265SMU25Cc6Xq0A4MlhjxwsG
TB0ouHlHqs3NlWqFtjuCZSS0mzNvbdW+ZaQV7dVKNM/+mhLsdnLPZsbtuHgIAY3d
cK4LXYU9qGCiR4FthiMDxHifmTD7QdSeqXA3F/+ecEjW7zbZSfJtVGZXIrP6Cuo2
tt8DZv0ComqcSrqPmNVmoarC0R086n6GntTF9B+lm9zl/EstQgH4jo1k2FLCEEa8
ErT5CbBpsZXlxyn6QhJkyZVf4JEO/KSrRbUze3jJYmwsUA8tBfCqmj+uF6GzyGAY
h0bXgvElBkaKAfDO0ix03pJpxKenXQ1+QN7tWiHcZWzWSwzMOMLCugJazeN/jbBI
JFDzUB/XBGk3ZQXEy5qwkMxY+o6oiWMR22n/gAKuWt3mTnzf/p5NepsZ0ujT3y9Y
nSZ5tAvadzLbmtaeFzBHCLGwhCRS/WE+C1aCsSjL0p6qQpZeqiQ/f4RXO8nDyu/s
4oee+cxeBzdJ37X9ixwN
=8BQZ
-----END PGP SIGNATURE-----

--uFCT/mKo947wgAms--