From: Scott Whitney <scott@journyx.com>
To: Murthy Nunna <mnunna@fnal.gov>
To: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: Postgresql v9.2.4 Kerberos Client Authentication
Date: Fri, 17 Jan 2014 16:05:57 -0600 (CST)
Message-ID: <fejbpt428ihw05ag1srcvqwk.1389996351414@email.android.com> (raw)
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
I don't have a lot of experience in that, specifically, but I _do_ have a lot lf experience getting screwed by firewalls and IP tables (and SE Linux) in particular. You might double check those.
-------- Original message --------
From: Murthy Nunna <mnunna@fnal.gov>
Date: 01/17/2014 4:02 PM (GMT-06:00)
To: pgsql-admin@postgresql.org
Subject: [ADMIN] Postgresql v9.2.4 Kerberos Client Authentication
Hello PG Admins,
I am new to postgres and also to the list. I am glad I found this domain list for help.
I am setting up streaming replication using Virtaul IP.
Server1 is primary which has its own server IP address
Server2 is standby which has its own server IP address
We created a virtual IP (say pgvip) which is different from server IPs. This IP will move between server1 and server2 to help provide application transparency. Application uses “pgvip”, so when the standby is converted to serve as primary, we move the virtual IP from server1 to server2 and simply bring up the application with no changes. That is the idea.
Everything works fine EXCEPT Kerberos client authentication. We put both server key (postgres/server1@fnal.gov) and VIP key (postgres/pgvip@fnal.gov) in the keytab but it still doesn’t work. When I specify physical hostname in the connect string of the client, Kerberos is able to authenticate. But when “pgvip” is used it fails.
Following is what I have in my postgresql.conf:
krb_server_keyfile = '/home/postgres/krb5/keytab'
krb_srvname = 'postgres’
I also tried krb_server_hostname in pg_hba file as below. It didn’t work either. May be this is supposed to work but it may be wrong syntactically.
host all mnunna 0.0.0.0/0 krb5 krb_server_hostname='minos-ecl-pgvip'
Please help. Is what we are trying supported in postgres? If so, please help me point in the right direction.
Thanks in advance for your help!
Murthy Nunna
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: scott@journyx.com, mnunna@fnal.gov
Subject: Re: Postgresql v9.2.4 Kerberos Client Authentication
In-Reply-To: <fejbpt428ihw05ag1srcvqwk.1389996351414@email.android.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox