Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.600.62\))
Subject: Re: Question about UNIX socket connections and SSL
From: Casey & Gina <cg@osss.net>
In-Reply-To: <1514893.1718219853@sss.pgh.pa.us>
Date: Wed, 12 Jun 2024 15:46:50 -0500
Cc: pgsql-general@postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <1E2A5972-443A-4C7B-88AA-3AE5E6415381@osss.net>
References: <5EDB1F7F-569B-48B2-8DCD-44EE17D41F1A@osss.net>
 <1514893.1718219853@sss.pgh.pa.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/1E2A5972-443A-4C7B-88AA-3AE5E6415381%40osss.net>
Precedence: bulk

> On Jun 12, 2024, at 2:17=E2=80=AFPM, Tom Lane <tgl@sss.pgh.pa.us> =
wrote:
>=20
> (1) It'd add overhead without adding any security.  Data going through
> a UNIX socket will only pass through the local kernel, and if that's
> compromised then it's game over anyway.

That's true.  My preference would be to have an unencrypted connection =
via UNIX socket from the application to haproxy, then an encrypted =
connection using SSL certificate authentication from haproxy to the =
database.  I spent some time attempting this.  But that doesn't seem to =
be possible since haproxy doesn't understand the postgres protocol.

--=20
Regards,
- Casey=