From: lejeczek <peljasz@yahoo.co.uk>
Cc: pgsql-admin@postgresql.org
Subject: Re: Replication & TLS encryption - how?
Date: Thu, 8 Apr 2021 09:21:30 +0100
Message-ID: <a217cf80-b5be-443f-f3df-445ee7b88b37@yahoo.co.uk> (raw)
In-Reply-To: <d7c701fd45117f1281f7342be412c5297610755f.camel@cybertec.at>
References: <54a5bf2b-0504-02c0-e5a2-ab24173abcdb.ref@yahoo.co.uk>
<54a5bf2b-0504-02c0-e5a2-ab24173abcdb@yahoo.co.uk>
<1596782.1617813374@sss.pgh.pa.us>
<7e89a9be-e788-23fc-6b1b-2ee67586d452@yahoo.co.uk>
<d7c701fd45117f1281f7342be412c5297610755f.camel@cybertec.at>
On 08/04/2021 03:59, Laurenz Albe wrote:
> On Wed, 2021-04-07 at 21:12 +0100, lejeczek wrote:
>> On 07/04/2021 17:36, Tom Lane wrote:
>>> lejeczek <peljasz@yahoo.co.uk> writes:
>>>> A novice here thus please go easy on me as I ask this - I
>>>> see docs/howtos all over the place be those either talk of
>>>> encryption or replication. I failed to find one which blend
>>>> these two concepts together - sure it's possible to pgSQL
>>>> replication encrypted, right?
>>> Replication connections work exactly like normal sessions for
>>> this purpose. Just make sure you set any required parameters
>>> in the standby's connection string.
>>>
>>> regards, tom lane
>>>
>>>
>> Thanks. Would you know how '|clientcert=1' fits into the
>> equation?
>> With it present in pg_hba.conf pgSQL was not happy saying:
>>
>> FATAL: connection requires a valid client certificate.
> Then include "sslcert" in "primary_conninfo".
>
> You can use all the libpq connection parameters:
> https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
>
> Yours,
> Laurenz Albe
This below is what 'pg_basebackup' generated on the master
itself, master which already was configured for TLS/certs.
primary_conninfo = 'user=replicator password=''9897''
channel_binding=prefer host=10.1.1.224 port=5432
sslmode=prefer sslcompression=0
ssl_min_protocol_version=TLSv1.2 gssencmode=prefer
krbsrvname=postgres target_session_attrs=any'
And with master's:
hostssl replication replicator 10.1.1.223/32 md5
clientcert=1
standby would not connect, but without 'clientcert=1' it
seems to work.
I guess my question - as any novice's - would be: is
replication really 100% encrypted? How to confirm-test it?
Lastly: is there anything more at 'pg_basebackup' stage user
can do to have 'configs' more ready, more complete for 'full
encryption' when starting with master already configured
with TLS?
I'm on 13.2 version.
many thanks, L.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: peljasz@yahoo.co.uk
Subject: Re: Replication & TLS encryption - how?
In-Reply-To: <a217cf80-b5be-443f-f3df-445ee7b88b37@yahoo.co.uk>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox