Message-ID: <84304703ff2131cb3302eaf12b31a235b25a76a6.camel@cybertec.at>
Subject: Re: Replication & TLS encryption - how?
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: lejeczek <peljasz@yahoo.co.uk>
Cc: pgsql-admin@postgresql.org
Date: Thu, 08 Apr 2021 12:27:17 +0200
In-Reply-To: <a217cf80-b5be-443f-f3df-445ee7b88b37@yahoo.co.uk>
References: <54a5bf2b-0504-02c0-e5a2-ab24173abcdb.ref@yahoo.co.uk>
	 <54a5bf2b-0504-02c0-e5a2-ab24173abcdb@yahoo.co.uk>
	 <1596782.1617813374@sss.pgh.pa.us>
	 <7e89a9be-e788-23fc-6b1b-2ee67586d452@yahoo.co.uk>
	 <d7c701fd45117f1281f7342be412c5297610755f.camel@cybertec.at>
	 <a217cf80-b5be-443f-f3df-445ee7b88b37@yahoo.co.uk>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.36.5 (3.36.5-2.fc32) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/84304703ff2131cb3302eaf12b31a235b25a76a6.camel%40cybertec.at>
Precedence: bulk

On Thu, 2021-04-08 at 09:21 +0100, lejeczek wrote:
> On 08/04/2021 03:59, Laurenz Albe wrote:
> > On Wed, 2021-04-07 at 21:12 +0100, lejeczek wrote:
> > > On 07/04/2021 17:36, Tom Lane wrote:
> > > > lejeczek <peljasz@yahoo.co.uk> writes:
> > > > > A novice here thus please go easy on me as I ask this - I
> > > > > see docs/howtos all over the place be those either talk of
> > > > > encryption or replication. I failed to find one which blend
> > > > > these two concepts together - sure it's possible to pgSQL
> > > > > replication encrypted, right?
> > > 
> > > Thanks. Would you know how '|clientcert=1' fits into the
> > > equation?
> > > With it present in pg_hba.conf pgSQL was not happy saying:
> > > 
> > > FATAL:  connection requires a valid client certificate.
> >
> > Then include "sslcert" in "primary_conninfo".
> > 
> > You can use all the libpq connection parameters:
> > https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
> 
> This below is what 'pg_basebackup' generated on the master 
> itself, master which already was configured for TLS/certs.
> 
> primary_conninfo = 'user=replicator password=''9897'' 
> channel_binding=prefer host=10.1.1.224 port=5432 
> sslmode=prefer sslcompression=0 
> ssl_min_protocol_version=TLSv1.2 gssencmode=prefer 
> krbsrvname=postgres target_session_attrs=any'
> 
> And with master's:
> 
> hostssl    replication     replicator      10.1.1.223/32 md5 
> clientcert=1

I repeat: add "sslcert" to "primary_conninfo".
Of course you will need a private key that matches the certificate.

> I guess my question - as any novice's - would be: is 
> replication really 100% encrypted? How to confirm-test it?

Look at the appropriate line in "pg_stat_ssl".

> Lastly: is there anything more at 'pg_basebackup' stage user 
> can do to have 'configs' more ready, more complete for 'full 
> encryption' when starting with master already configured 
> with TLS?
> I'm on 13.2 version.

No, this always requires manual configuration.

Yours,
Laurenz Albe
-- 
Cybertec | https://www.cybertec-postgresql.com