Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lAi34-00074d-Ld for pgsql-admin@arkaria.postgresql.org; Fri, 12 Feb 2021 23:40:31 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lAi32-0000uW-Io for pgsql-admin@arkaria.postgresql.org; Fri, 12 Feb 2021 23:40:28 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lAi31-0000uO-Ok for pgsql-admin@lists.postgresql.org; Fri, 12 Feb 2021 23:40:28 +0000 Received: from mail-bn8nam11olkn2057.outbound.protection.outlook.com ([40.92.20.57] helo=NAM11-BN8-obe.outbound.protection.outlook.com) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lAi2x-0002me-82 for pgsql-admin@postgresql.org; Fri, 12 Feb 2021 23:40:26 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jgEJhUcymIgOsgR7x497al3ExH6JLtLBY+Y4LC7FFMSDTDU1mWsJTANcgB3JqVOgeGipPmmtIZKihhSk2eNbHXyr0bKcm76NhDMHD+ROo/FgPRbxRw3WJxeEGsE4RA0h+GxuxM2zMvqQUrE6h/4Y0fkCLENiZcyCAysrZy3KQ+QeeRHIR1nfwI+uDi6FwXA6JPVkJKV8PZ6HCTFZufh1+ZgZ71jq4OJ9O5PRuY7I6O8pgpzFinvYjPB72339KZM73CGlajN/4gysOasbOQLnXEr6/5M6girs9Vy4lZNRtfW/K2kBeS6IsBRsOP4TyLQb+9R4ZmQni5XHte2QANr7qg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cN0SlnSLKqXCTuqerURg0K3KfXJPR94sz+VKvouVbQI=; b=ZSwRsxh7CK59kc+zD+Fov3bVWL/bWP3zjgSFjfHzIrB0p9k+ZKsVF2miP81VMIrx88ZkpJcX+NCGRtWzPHXHW3NcpcQnttvoYENqqq3/vNqbXyF6L9L/NsmrmGQuP+KzCVgPN5QSHiLxQbQrgG58gEAHz9q6gkI807PLOohW0pa2LxmVlqGqoEYWU/cRl/s2rlL3tzv+0UX77Z/TEVNoSnJuFi/T/4q9PCy9hoqXranflDFAnA5eSF7zr7FaOEr+nD5c4eH51IZjlc0PWa9OVCp1lTzdsBt3P/Basti+8g7yMMBERNN80gZVdER9i5/ynpuvP5SAB3l2ZjWEjH6/iw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cN0SlnSLKqXCTuqerURg0K3KfXJPR94sz+VKvouVbQI=; b=SgeMQAtbcLTrFLMvAECO4rxPFIuk808ytOQ6i5z4k1zKd1ZKUorWnTHadrCaYxfErNBwe++EllAHYCCFxs3frAlkXBDXHoctMRCEYzLwD9ihASsVuv+HaIZHiaR+rgjFCaJE815k01nxmu+wk7uwS584MUhLyKD3bn2Fzs8+cWtHko7I1QRXHs81RJShDfZtA/lDjUCw9yZFW7HLAsd6PFSX86l7jODaFLyP8mVewmU2bJ/2J8Bq1d/aggDJ8d6Te5TPOLHoXhN0P+gPlGjylBdE8TNw8QFJ/EThgYmQs+htgFuZf0vHueLOCVyNTY1G6IH1UckTRsbWzPYCAZBGiQ== Received: from BN8NAM11FT028.eop-nam11.prod.protection.outlook.com (2a01:111:e400:fc4b::41) by BN8NAM11HT151.eop-nam11.prod.protection.outlook.com (2a01:111:e400:fc4b::205) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3846.25; Fri, 12 Feb 2021 23:40:20 +0000 Received: from DM6PR02MB4572.namprd02.prod.outlook.com (2a01:111:e400:fc4b::43) by BN8NAM11FT028.mail.protection.outlook.com (2a01:111:e400:fc4b::225) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3846.25 via Frontend Transport; Fri, 12 Feb 2021 23:40:20 +0000 Received: from DM6PR02MB4572.namprd02.prod.outlook.com ([fe80::100:113b:84ac:609c]) by DM6PR02MB4572.namprd02.prod.outlook.com ([fe80::100:113b:84ac:609c%6]) with mapi id 15.20.3846.028; Fri, 12 Feb 2021 23:40:19 +0000 From: jian xu To: Tom Lane CC: pgsql-admin Subject: Re: pg13 psql can't connect pg instance with ssl enabled after upgrading Thread-Topic: pg13 psql can't connect pg instance with ssl enabled after upgrading Thread-Index: AQHXAYFaIm9lVLzuPkiaHpDJpBu0LKpVDx6AgAAAXBGAABMHAIAACgA/ Date: Fri, 12 Feb 2021 23:40:19 +0000 Message-ID: References: ,<1608034.1613166623@sss.pgh.pa.us> ,<1611195.1613170786@sss.pgh.pa.us> In-Reply-To: <1611195.1613170786@sss.pgh.pa.us> Accept-Language: en-US, zh-CN Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-incomingtopheadermarker: OriginalChecksum:45CAC9214F3C170C6784B29A8B46017A16F63ED791021B5EFA0F8821BFCB9D3C;UpperCasedChecksum:66E5B784E00E4BED4302EECE54A9DC428E6EF3CE153229A7431CF57102100C69;SizeAsReceived:7101;Count:45 x-ms-exchange-messagesentrepresentingtype: 1 x-tmn: [pcS2U1o3tXId3GHXaVMK7YVdeCehctXF] x-ms-publictraffictype: Email x-incomingheadercount: 45 x-eopattributedmessage: 0 x-ms-office365-filtering-correlation-id: ee798ee2-6c0f-491a-ad0a-08d8cfaf8f01 x-ms-traffictypediagnostic: BN8NAM11HT151: x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: J0c8fZWZvXbkAhLZytxchGK5Q9rpm//BrfY9cmEmV1AK/gJhlOVR4Q4c3qTeWT4jOq7/OJYzaWq8Oc5RMTMcLurGipTZ2TkbmeoL+ne7tV3bvvmEo+bf7F2hnCVp30ah4UYGzesgT/1UyaZdn1Qk41sKtbW5m1gPhWrMPGBbbExbYNO9jsYYg7y+y1mnY5aYVzdOgp8r+IwAIUaShuZ5sz8NKsIKTXXceqPdR0uvmRyvPQPycXO0FMJbcYVwpij+jg6/2uf0lLrSxGkdIsQhBmz4yCdwaRxks2NIJarQZ9wFF6++VvUzUFYAcwThFEfttzwdUGz0RkLH/AHVROpMlHVoCJcMDKznH0R5x0+NvG1DlglOwpFOIlbMZ31JxnIKX34H6+Bn/yJFRVDDcxLjPQ== x-ms-exchange-antispam-messagedata: P+07yMUrXVB55+YIC7ddg7k4+etpdsxXmH4ZqSit07QCcdm9YVKOjc2L6HX/rMCe+GjywqgeDq6pNYl9dakCVDLEOWTTBBtsmDx9sAe/OHgSuKw9KLQZq1rBkvKwmXMT28Mon0F0F8tABKIKNZX7eQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR02MB4572889A58404358C7ADD1CBA18B9DM6PR02MB4572namp_" MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT028.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: ee798ee2-6c0f-491a-ad0a-08d8cfaf8f01 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Feb 2021 23:40:19.7363 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8NAM11HT151 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_DM6PR02MB4572889A58404358C7ADD1CBA18B9DM6PR02MB4572namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable thanks Tom, may I know if there is a way to disable GSS encryption? and onl= y use ssl encryption? not sure why it worked on pg11, but not on pg13.... does it mean if we use GSS, we are not able to use ssl encryption on pg13? thanks, James ________________________________ From: Tom Lane Sent: Friday, February 12, 2021 17:59 To: jian xu Cc: pgsql-admin Subject: Re: pg13 psql can't connect pg instance with ssl enabled after upg= rading jian xu writes: > Thanks Tom. you are right, we are using GSS authentication. and psql ver= sion is 13.1 > postgresql_13_1/bin/psql --version > psql (PostgreSQL) 13.1 Ah. Then perhaps you want hostgssenc not hostssl in your pg_hba entries. But I'd definitely recommend an update to 13.2, as it fixes a number of GSS bugs besides this one. regards, tom lane --_000_DM6PR02MB4572889A58404358C7ADD1CBA18B9DM6PR02MB4572namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
thanks Tom, may I know if there is a way to disable GSS encryption? an= d only use ssl encryption?
not sure why it worked on pg11, but not on pg13....
does it mean if we use GSS, we are not able to use ssl encryption on pg13?&= nbsp;
thanks,
James
From: Tom Lane <tgl@sss.= pgh.pa.us>
Sent: Friday, February 12, 2021 17:59
To: jian xu <jamesxu@outlook.com>
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: pg13 psql can't connect pg instance with ssl enabled af= ter upgrading
 
jian xu <jamesxu@outlook.com> writes:
> Thanks Tom.  you are right, we are using GSS authentication. and = psql version is 13.1
> postgresql_13_1/bin/psql --version
> psql (PostgreSQL) 13.1

Ah.  Then perhaps you want hostgssenc not hostssl in your pg_hba
entries.  But I'd definitely recommend an update to 13.2, as it
fixes a number of GSS bugs besides this one.

            &nb= sp;           regards, to= m lane
--_000_DM6PR02MB4572889A58404358C7ADD1CBA18B9DM6PR02MB4572namp_--