Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpw0G-0001me-BT for pgsql-general@arkaria.postgresql.org; Thu, 17 Dec 2020 16:19:44 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kpw0E-0003NP-8G for pgsql-general@arkaria.postgresql.org; Thu, 17 Dec 2020 16:19:42 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpw0D-0003NI-SY for pgsql-general@lists.postgresql.org; Thu, 17 Dec 2020 16:19:42 +0000 Received: from smtpout1.smhi.se ([2001:67c:274:5501::30]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpw0A-000705-AM for pgsql-general@postgresql.org; Thu, 17 Dec 2020 16:19:40 +0000 Received: from winserv743.ad.smhi.se (winserv743.ad.smhi.se [172.16.6.38]) by smtpout1.smhi.se (Postfix) with ESMTPS id 7D7D910950B9; Thu, 17 Dec 2020 16:19:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smhi.se; s=20180112; t=1608221973; bh=a5TfTzDpPrYKQiyzIcho4zjrwLOZ9EwW2mJgdCXCABA=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=wU13sZaw8HVEO+pb0O2zoX9Bckm7yXWuXzZkvLPnhtGaqJCMUbIQb+NtAP8Ga5WG4 ySAynqj2sVbVxu5ODgwEn+F08vzME9mN+L+Ur740p+YRqsN9aMZBP5BrAUBzH/HMrG 5J3oIAUpHqYui2p/DPSxrugXFDyySg3jNkSqww8s= Received: from winserv744.ad.smhi.se (172.16.6.35) by winserv743.ad.smhi.se (172.16.6.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Thu, 17 Dec 2020 17:19:33 +0100 Received: from winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b]) by winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b%9]) with mapi id 15.01.2106.006; Thu, 17 Dec 2020 17:19:33 +0100 From: Gustavsson Mikael To: Magnus Hagander CC: Tom Lane , Kyotaro Horiguchi , "pgsql-general@postgresql.org" , Svensson Peter Subject: SV: SV: Problem with ssl and psql in Postgresql 13 Thread-Topic: SV: Problem with ssl and psql in Postgresql 13 Thread-Index: AQHW1ER+dWnFD/e9/0CWjk1hYinUxan65DcAgAAT2weAAE4KgIAAEwPs///2LoCAAB6Q7f//9RsAgAAS+1U= Date: Thu, 17 Dec 2020 16:19:33 +0000 Message-ID: <698125e1105644adaa27578bb37b18f6@smhi.se> References: <20201217.172938.170511532557914014.horikyota.ntt@gmail.com> <06191eae74d045e192a786a84a73ba53@smhi.se> <65644.1608214801@sss.pgh.pa.us> , In-Reply-To: Accept-Language: sv-SE, en-US Content-Language: sv-SE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.122.0.145] Content-Type: multipart/alternative; boundary="_000_698125e1105644adaa27578bb37b18f6smhise_" MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_698125e1105644adaa27578bb37b18f6smhise_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sorry, my bad. But i get the same result. $ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Dserver sslm= ode=3Drequire" psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "ka= lle", database "postgres", SSL off FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", databas= e "postgres", SSL off /Mikael ________________________________ Fr=E5n: Magnus Hagander Skickat: den 17 december 2020 17:03:18 Till: Gustavsson Mikael Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson = Peter =C4mne: Re: SV: Problem with ssl and psql in Postgresql 13 That's setting a variable, not a parameter. You need something like psql "dbname=3Dpostgres user=3Dkalle host=3Dserver sslmode=3Drequire" Or PGSSLMODE=3Drequire /usr/bin/pgsql-same-as-you-had-before //Magnus On Thu, Dec 17, 2020 at 5:00 PM Gustavsson Mikael wrote: > > Hi Magnus, > > > The clients 11 and 13 is on the same host. > > > Hmm, I get the same error if I set sslmode=3Drequire. > > > $ /usr/pgsql-13/bin/psql -d postgres --set=3Dsslmode=3Drequire -Ukalle -h= server -W > Password: > psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "= kalle", database "postgres", SSL off > FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", datab= ase "postgres", SSL off > > KR Mikael Gustavsson, SMHI > > > ________________________________ > Fr=E5n: Magnus Hagander > Skickat: den 17 december 2020 15:52:55 > Till: Gustavsson Mikael > Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensso= n Peter > =C4mne: Re: SV: Problem with ssl and psql in Postgresql 13 > > On Thu, Dec 17, 2020 at 3:36 PM Gustavsson Mikael > wrote: > > > > > > Hi, > > > > log_connections is on. The ERR message is correct, we do not have an en= try for SSL off. > > The question is why psql(13) is trying to connect without ssl? > > > > 2020-12-17T14:25:09.565566+00:00 server INFO [30-1] pgpid=3D2422778 pgu= ser=3D[unknown] pghost=3Dnnn.nn.n.nnn pgdb=3D[unknown] pgapp=3D[unknown] LO= G: connection received: host=3Dnnn.nn.n.nnn port=3D40112 > > 2020-12-17T14:25:09.566411+00:00 server ERR [31-1] pgpid=3D2422778 pgus= er=3Dkalle pghost=3Dnnn.nn.n.nnn pgdb=3Dpostgres pgapp=3D[unknown] FATAL: = no pg_hba.conf entry for host "nnn.nn.n.nnn", user "kalle", database "postg= res", SSL off > > > By default psql/libpq will fall back to a clear text connection if the > ssl encrypted one failed. Specify sslmode=3Drequire (or preferably > higher) in the connection string or set PGSSLMODE=3Drequire on the > client to disable that behavior. If you do that, my guess is you will > see a direct connection failure instead of that error? > > PostgreSQL 13 did change the default value for minimum tls version to > 1.2. But that seems unlikely to be the problem since you get TLS 1.3 > when you use the old version... > > I assume you're running both the 11 and the 13 client on the same host? -- Magnus Hagander Me: https://www.hagander.net/ Work: https://www.redpill-linpro.com/ --_000_698125e1105644adaa27578bb37b18f6smhise_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable


Sorry, my bad. But i get the same result.


$ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Ds= erver sslmode=3Drequire"
psql: error: FATAL:  no pg_hba.conf entry for host "nn.nnn.n= .nnn", user "kalle", database "postgres", SSL off<= /div>
FATAL:  no pg_hba.conf entry for host "nn.nnn.n.nnn", u= ser "kalle", database "postgres", SSL off

/Mikael

Fr=E5n: Magnus Hagander &= lt;magnus@hagander.net>
Skickat: den 17 december 2020 17:03:18
Till: Gustavsson Mikael
Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Sv= ensson Peter
=C4mne: Re: SV: Problem with ssl and psql in Postgresql 13
 
That's setting a variable, not a parameter.

You need something like

psql "dbname=3Dpostgres user=3Dkalle host=3Dserver sslmode=3Drequire&q= uot;

Or
PGSSLMODE=3Drequire /usr/bin/pgsql-same-as-you-had-before

//Magnus

On Thu, Dec 17, 2020 at 5:00 PM Gustavsson Mikael
<mikael.gustavsson@smhi.se> wrote:
>
> Hi Magnus,
>
>
> The clients 11 and 13 is on the same host.
>
>
> Hmm, I get the same error if I set sslmode=3Drequire.
>
>
> $ /usr/pgsql-13/bin/psql -d postgres --set=3Dsslmode=3Drequire -Ukalle= -hserver -W
> Password:
> psql: error: FATAL:  no pg_hba.conf entry for host "nn.nnn.n= .nnn", user "kalle", database "postgres", SSL off<= br> > FATAL:  no pg_hba.conf entry for host "nn.nnn.n.nnn", u= ser "kalle", database "postgres", SSL off
>
> KR Mikael Gustavsson, SMHI
>
>
> ________________________________
> Fr=E5n: Magnus Hagander <magnus@hagander.net>
> Skickat: den 17 december 2020 15:52:55
> Till: Gustavsson Mikael
> Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Sven= sson Peter
> =C4mne: Re: SV: Problem with ssl and psql in Postgresql 13
>
> On Thu, Dec 17, 2020 at 3:36 PM Gustavsson Mikael
> <mikael.gustavsson@smhi.se> wrote:
> >
> >
> > Hi,
> >
> > log_connections is on. The ERR message is correct, we do not have= an entry for SSL off.
> > The question is why psql(13) is trying to connect without ssl? > >
> > 2020-12-17T14:25:09.565566+00:00 server INFO [30-1] pgpid=3D2= 422778 pguser=3D[unknown] pghost=3Dnnn.nn.n.nnn pgdb=3D[unknown] pgapp=3D[u= nknown] LOG:  connection received: host=3Dnnn.nn.n.nnn port=3D40112 > > 2020-12-17T14:25:09.566411+00:00 server ERR [31-1] pgpid=3D24= 22778 pguser=3Dkalle pghost=3Dnnn.nn.n.nnn pgdb=3Dpostgres pgapp=3D[unknown= ] FATAL:  no pg_hba.conf entry for host "nnn.nn.n.nnn", user= "kalle", database "postgres", SSL off
>
>
> By default psql/libpq will fall back to a clear text connection if the=
> ssl encrypted one failed. Specify sslmode=3Drequire (or preferably
> higher) in the connection string or set PGSSLMODE=3Drequire on the
> client to disable that behavior. If you do that, my guess is you will<= br> > see a direct connection failure instead of that error?
>
> PostgreSQL 13 did change the default value for minimum tls version to<= br> > 1.2. But that seems unlikely to be the problem since you get TLS 1.3 > when you use the old version...
>
> I assume you're running both the 11 and the 13 client on the same host= ?


--
 Magnus Hagander
 Me: https://www.hagander.net/
 Work: = https://www.redpill-linpro.com/


--_000_698125e1105644adaa27578bb37b18f6smhise_--