From: Magnus Hagander <magnus@hagander.net>
To: Murthy Nunna <mnunna@fnal.gov>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: Postgresql v9.2.4 Kerberos Client Authentication
Date: Sat, 18 Jan 2014 12:12:55 +0100
Message-ID: <CABUevExt7apTi-Q9jkFWTXC91sf70Yqxpij2NSXooxtsNZvePw@mail.gmail.com> (raw)
In-Reply-To: <BD7563973EF8894D905C80593EE9A4ED307B22@MAIL01.fnal.gov>
References: <BD7563973EF8894D905C80593EE9A4ED307B22@MAIL01.fnal.gov>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
On Fri, Jan 17, 2014 at 11:00 PM, Murthy Nunna <mnunna@fnal.gov> wrote:
> Hello PG Admins,
>
>
>
> I am new to postgres and also to the list. I am glad I found this domain
> list for help.
>
>
>
> I am setting up streaming replication using Virtaul IP.
>
>
>
> Server1 is primary which has its own server IP address
>
> Server2 is standby which has its own server IP address
>
>
>
> We created a virtual IP (say pgvip) which is different from server IPs.
> This IP will move between server1 and server2 to help provide application
> transparency. Application uses “pgvip”, so when the standby is converted to
> serve as primary, we move the virtual IP from server1 to server2 and simply
> bring up the application with no changes. That is the idea.
>
>
>
> Everything works fine EXCEPT Kerberos client authentication. We put both
> server key (postgres/server1@fnal.gov) and VIP key (
> postgres/pgvip@fnal.gov) in the keytab but it still doesn’t work. When I
> specify physical hostname in the connect string of the client, Kerberos is
> able to authenticate. But when “pgvip” is used it fails.
>
>
>
> Following is what I have in my postgresql.conf:
>
>
>
> krb_server_keyfile = '/home/postgres/krb5/keytab'
>
> krb_srvname = 'postgres’
>
>
>
> I also tried krb_server_hostname in pg_hba file as below. It didn’t work
> either. May be this is supposed to work but it may be wrong syntactically.
>
>
>
> host all mnunna 0.0.0.0/0 krb5
> krb_server_hostname='minos-ecl-pgvip'
>
>
>
> Please help. Is what we are trying supported in postgres? If so, please
> help me point in the right direction.
>
>
>
First of all, note that krb5 has been deprecated for several releases now,
and you should probably be using "gss". That will use Kerberos "under the
hood", but do so using a standard protocol.
Second - Kerberos is notoriously sensitive to DNS setups. Make sure you
have both forward and reverse lookups working correctly for the VIP
address. I've also generally seen better results if you use the FQDN of the
hosts - both when accessing them and of course in they keys.
I would remove the server key from the keytab - it's supposed to pick it
automatically, but I've seen issues sometimes with some kerberos libraries
where it hasn't worked.
(The last two points are generic Kerberos points and not directly about
PostgreSQL of course)
--
Magnus Hagander
Me: http://www.hagander.net/
Work: http://www.redpill-linpro.com/
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: magnus@hagander.net, mnunna@fnal.gov
Subject: Re: Postgresql v9.2.4 Kerberos Client Authentication
In-Reply-To: <CABUevExt7apTi-Q9jkFWTXC91sf70Yqxpij2NSXooxtsNZvePw@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox