pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedPostgreSQL SSL params
5+ messages / 3 participants
[nested] [flat]
* PostgreSQL SSL params
@ 2021-06-13 14:20 pramod kg <pramod11287@gmail.com>
0 siblings, 2 replies; 5+ messages in thread
From: pramod kg @ 2021-06-13 14:20 UTC (permalink / raw)
To: pgsql-admin
Hi,
I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH".
Still, the security team complains that weak ciphers are accepted at server
side (They have run some security tests). Security team suggesting to use
ssl_dh_params_file.
As per my understanding, DH is a key exchange protocol (read in some
forum). DH is used to securely generate a common key between two parties,
other algorithms are used for encryption itself. So I believe that dhparam
does not help in resolving weak cipher issues. Need some insight on this.
Also, Are there any changes required at client side to connect to the
database if ssl_dh_params_file is set at server side?
how to make sure that PG accepts only high ciphers? Please suggest.
Note: I have installed PG version 13.1 on a few servers and 13.3 on a few
servers.
Regards,
Pramod
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: PostgreSQL SSL params
@ 2021-06-13 15:04 Tom Lane <tgl@sss.pgh.pa.us>
parent: pramod kg <pramod11287@gmail.com>
1 sibling, 1 reply; 5+ messages in thread
From: Tom Lane @ 2021-06-13 15:04 UTC (permalink / raw)
To: pramod kg <pramod11287@gmail.com>; +Cc: pgsql-admin
pramod kg <pramod11287@gmail.com> writes:
> I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH".
> Still, the security team complains that weak ciphers are accepted at server
> side (They have run some security tests).
The default setting of that is
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
Perhaps the problem is your ill-advised removal of the !aNULL part.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: PostgreSQL SSL params
@ 2021-06-14 03:43 pramod kg <pramod11287@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 5+ messages in thread
From: pramod kg @ 2021-06-14 03:43 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin
Should it be combination of
'HIGH:!aNULL' ??
Regards,
Pramod
On Sun, 13 Jun 2021, 20:34 Tom Lane, <tgl@sss.pgh.pa.us> wrote:
> pramod kg <pramod11287@gmail.com> writes:
> > I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH".
> > Still, the security team complains that weak ciphers are accepted at
> server
> > side (They have run some security tests).
>
> The default setting of that is
>
> #ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
>
> Perhaps the problem is your ill-advised removal of the !aNULL part.
>
> regards, tom lane
>
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: PostgreSQL SSL params
@ 2021-06-14 07:53 Peter Eisentraut <peter.eisentraut@enterprisedb.com>
parent: pramod kg <pramod11287@gmail.com>
1 sibling, 1 reply; 5+ messages in thread
From: Peter Eisentraut @ 2021-06-14 07:53 UTC (permalink / raw)
To: pramod kg <pramod11287@gmail.com>; pgsql-admin
On 13.06.21 16:20, pramod kg wrote:
> I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH".
> Still, the security team complains that weak ciphers are accepted at
> server side (They have run some security tests).
Try to get a list of specific ciphers that they object to. Then you can
use "openssl ciphers" and SSL_CTX_set_cipher_list(3) to tune your settings.
> Security team
> suggesting to use ssl_dh_params_file.
>
> As per my understanding, DH is a key exchange protocol (read in some
> forum). DH is used to securely generate a common key between two
> parties, other algorithms are used for encryption itself. So I
> believe that dhparam does not help in resolving weak cipher issues. Need
> some insight on this.
I think you are correct on this.
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: PostgreSQL SSL params
@ 2021-06-14 08:47 pramod kg <pramod11287@gmail.com>
parent: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
0 siblings, 0 replies; 5+ messages in thread
From: pramod kg @ 2021-06-14 08:47 UTC (permalink / raw)
To: Peter Eisentraut <peter.eisentraut@enterprisedb.com>; +Cc: pgsql-admin
Try to get a list of specific ciphers that they object to. Then you can
use "openssl ciphers" and SSL_CTX_set_cipher_list(3) to tune your settings.
Okay. Will do thanks.
On Mon, Jun 14, 2021 at 1:23 PM Peter Eisentraut <
peter.eisentraut@enterprisedb.com> wrote:
> On 13.06.21 16:20, pramod kg wrote:
> > I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH".
> > Still, the security team complains that weak ciphers are accepted at
> > server side (They have run some security tests).
>
> Try to get a list of specific ciphers that they object to. Then you can
> use "openssl ciphers" and SSL_CTX_set_cipher_list(3) to tune your settings.
>
> > Security team
> > suggesting to use ssl_dh_params_file.
> >
> > As per my understanding, DH is a key exchange protocol (read in some
> > forum). DH is used to securely generate a common key between two
> > parties, other algorithms are used for encryption itself. So I
> > believe that dhparam does not help in resolving weak cipher issues. Need
> > some insight on this.
>
> I think you are correct on this.
>
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2021-06-14 08:47 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-06-13 14:20 PostgreSQL SSL params pramod kg <pramod11287@gmail.com>
2021-06-13 15:04 ` Tom Lane <tgl@sss.pgh.pa.us>
2021-06-14 03:43 ` pramod kg <pramod11287@gmail.com>
2021-06-14 07:53 ` Peter Eisentraut <peter.eisentraut@enterprisedb.com>
2021-06-14 08:47 ` pramod kg <pramod11287@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox