From: Gustavsson Mikael <mikael.gustavsson@smhi.se>
To: Magnus Hagander <magnus@hagander.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: pgsql-general@postgresql.org <pgsql-general@postgresql.org>
Cc: Svensson Peter <peter.svensson@smhi.se>
Subject: SV: SV: Problem with ssl and psql in Postgresql 13
Date: Thu, 17 Dec 2020 16:19:33 +0000
Message-ID: <698125e1105644adaa27578bb37b18f6@smhi.se> (raw)
In-Reply-To: <CABUevEz_eHh=R6C_C7GChF8w_aG4pMPDAvjJFa92cspAb3SSkg@mail.gmail.com>
References: <e5b0b6ed05764324a2f3fe7acfc766d5@smhi.se>
<20201217.172938.170511532557914014.horikyota.ntt@gmail.com>
<06191eae74d045e192a786a84a73ba53@smhi.se>
<65644.1608214801@sss.pgh.pa.us>
<a748b98ff0a94fe0a1ca54872ec5a25e@smhi.se>
<CABUevEz0tuQzXYmgDGDsbhs+8V-WOp2cSpM1S70S5L+gSDRGUg@mail.gmail.com>
<a9e6ef756df24fba948b5c09b1f30229@smhi.se>
<CABUevEz_eHh=R6C_C7GChF8w_aG4pMPDAvjJFa92cspAb3SSkg@mail.gmail.com>
Sorry, my bad. But i get the same result.
$ /usr/pgsql-13/bin/psql "dbname=postgres user=kalle host=server sslmode=require"
psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
/Mikael
________________________________
Från: Magnus Hagander <magnus@hagander.net>
Skickat: den 17 december 2020 17:03:18
Till: Gustavsson Mikael
Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
Ämne: Re: SV: Problem with ssl and psql in Postgresql 13
That's setting a variable, not a parameter.
You need something like
psql "dbname=postgres user=kalle host=server sslmode=require"
Or
PGSSLMODE=require /usr/bin/pgsql-same-as-you-had-before
//Magnus
On Thu, Dec 17, 2020 at 5:00 PM Gustavsson Mikael
<mikael.gustavsson@smhi.se> wrote:
>
> Hi Magnus,
>
>
> The clients 11 and 13 is on the same host.
>
>
> Hmm, I get the same error if I set sslmode=require.
>
>
> $ /usr/pgsql-13/bin/psql -d postgres --set=sslmode=require -Ukalle -hserver -W
> Password:
> psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
> FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
>
> KR Mikael Gustavsson, SMHI
>
>
> ________________________________
> Från: Magnus Hagander <magnus@hagander.net>
> Skickat: den 17 december 2020 15:52:55
> Till: Gustavsson Mikael
> Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
> Ämne: Re: SV: Problem with ssl and psql in Postgresql 13
>
> On Thu, Dec 17, 2020 at 3:36 PM Gustavsson Mikael
> <mikael.gustavsson@smhi.se> wrote:
> >
> >
> > Hi,
> >
> > log_connections is on. The ERR message is correct, we do not have an entry for SSL off.
> > The question is why psql(13) is trying to connect without ssl?
> >
> > 2020-12-17T14:25:09.565566+00:00 server INFO [30-1] pgpid=2422778 pguser=[unknown] pghost=nnn.nn.n.nnn pgdb=[unknown] pgapp=[unknown] LOG: connection received: host=nnn.nn.n.nnn port=40112
> > 2020-12-17T14:25:09.566411+00:00 server ERR [31-1] pgpid=2422778 pguser=kalle pghost=nnn.nn.n.nnn pgdb=postgres pgapp=[unknown] FATAL: no pg_hba.conf entry for host "nnn.nn.n.nnn", user "kalle", database "postgres", SSL off
>
>
> By default psql/libpq will fall back to a clear text connection if the
> ssl encrypted one failed. Specify sslmode=require (or preferably
> higher) in the connection string or set PGSSLMODE=require on the
> client to disable that behavior. If you do that, my guess is you will
> see a direct connection failure instead of that error?
>
> PostgreSQL 13 did change the default value for minimum tls version to
> 1.2. But that seems unlikely to be the problem since you get TLS 1.3
> when you use the old version...
>
> I assume you're running both the 11 and the 13 client on the same host?
--
Magnus Hagander
Me: https://www.hagander.net/
Work: https://www.redpill-linpro.com/
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: mikael.gustavsson@smhi.se, magnus@hagander.net, tgl@sss.pgh.pa.us, horikyota.ntt@gmail.com, peter.svensson@smhi.se
Subject: Re: SV: SV: Problem with ssl and psql in Postgresql 13
In-Reply-To: <698125e1105644adaa27578bb37b18f6@smhi.se>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox