DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:to:subject:mime-version:content-type
	:content-transfer-encoding:content-disposition;
	b=W0p9L0jbughvo20SAxsaupHvhZvEbZW5lILlU9z2BAoCLnwsJH0meZc59Qcni7TcW0
	1DNQc6dU6pabeZYgoFnVX9XbZI8HNUrrndRNUFp2mb4pAG1pugq4So7tlewWAIlHSrpX
	gBFKlb9GF/zGUE/hvKyLBGXLYcBeLo7NW9Bv4=
Message-ID: <4544e0330810291007p5b68fba2o4ee782b4d4f92878@mail.gmail.com>
Date: Wed, 29 Oct 2008 12:07:03 -0500
From: "Peter Koczan" <pjkoczan@gmail.com>
To: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: SSL and md5 password?
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi all,

I'm looking to add an md5-based user to a postgres server, and I can't
seem to get psql to connect using SSL. Normally I use Kerberos to
connect, and that works flawlessly with SSL. I'd much prefer to use
SSL connections, so I'm wondering if there's something I'm doing
wrong.

Here's what happens with a Kerberos connection...works just fine,
connects using SSL:

$ /s/postgresql/bin/psql -h dumbo.cs.wisc.edu -p 5432 koczan_test
Welcome to psql 8.3.4, the PostgreSQL interactive terminal.

Type:  \copyright for distribution terms
       \h for help with SQL commands
       \? for help with psql commands
       \g or terminate with semicolon to execute query
       \q to quit

SSL connection (cipher: DHE-RSA-AES256-SHA, bits: 256)

koczan_test=>

And an md5 connection...

$ /s/postgresql/bin/psql -h dumbo.cs.wisc.edu -p 5432 -U test_md5 koczan_test
Password for user test_md5:
psql: FATAL:  no pg_hba.conf entry for host "128.105.162.36", user
"test_md5", database "koczan_test", SSL off

Here's my pg_hba.conf

# TYPE  DATABASE    USER        CIDR-ADDRESS       METHOD

# this part disables remote "postgres" superuser connections
hostssl all         postgres    127.0.0.1/32       krb5
hostssl all         postgres    128.105.2.15/32    krb5
hostssl all         postgres    128.105.207.19/32  krb5
hostssl all         postgres    128.105.0.0/16     reject
hostssl all         postgres    198.133.224.0/24   reject

# Testing out md5 users
hostssl all         test_md5      128.105.0.0/16     md5
hostssl all         test_md5      198.133.224.0/24   md5

# this part enables non-superuser connections
hostssl all         nobody      128.105.0.0/16     trust
hostssl all         nobody      198.133.224.0/24   trust
hostssl all         all         128.105.0.0/16     krb5
hostssl all         all         198.133.224.0/24   krb5

And "ssl = on" in my postgresql.conf.

Am I missing something, or am I just SOL when using SSL?

Thanks,
Peter