MIME-Version: 1.0
From: Alexander Farber <alexander.farber@gmail.com>
Date: Fri, 28 Feb 2025 15:52:32 +0100
Message-ID: <CAADeyWjTfKCyDusy1biPAWmhJWh+9hSNrm219uV7UM7UnmaJ8Q@mail.gmail.com>
Subject: Azure Database for PostgreSQL flexible server: password
 authentication failed
To: pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="00000000000084107e062f34f593"
Archived-At: <https://www.postgresql.org/message-id/CAADeyWjTfKCyDusy1biPAWmhJWh%2B9hSNrm219uV7UM7UnmaJ8Q%40mail.gmail.com>
Precedence: bulk

--00000000000084107e062f34f593
Content-Type: text/plain; charset="UTF-8"

Good afternoon,

I am using an Azure Database for PostgreSQL flexible server with no public
ip.

It is connected to a private VNet and I try to access it from an Alpine
Linux container with openssl and postgresql-client installed.

In Azure portal I have clicked the "Reset password" button, entered
twice password12345!! and received the web browser notification
"Successfully reset the password for postgresql"

Then I run the commands:

$ openssl s_client -connect 172.21.32.4:5432 -starttls postgres
(then after some time)
2C820000:error:8000274C:system library:BIO_connect:Unknown
error:../openssl-3.2.3/crypto/bio/bio_sock2.c:178:calling connect()
2C820000:error:10000067:BIO routines:BIO_connect:connect
error:../openssl-3.2.3/crypto/bio/bio_sock2.c:180:
connect:errno=0

$ PGPASSWORD="password12345!!" psql "postgresql://postgres:password12345!!@
172.21.32.4:5432/postgres?sslmode=require"
psql: error: connection to server at "172.21.32.4", port 5432 failed:
FATAL:  password authentication failed for user "postgres"

In the server logs I see entries for some other connections:

2025-02-28 14:39:35 UTC-67c1ca93.50ee-LOG:  disconnection: session time:
0:00:20.024 user=azuresu database=postgres host=169.254.128.1 port=53076
2025-02-28 14:39:36 UTC-67c1caa8.5146-LOG:  connection received:
host=169.254.128.1 port=49016
2025-02-28 14:39:36 UTC-67c1caa8.5146-LOG:  connection authenticated:
identity=\"CN=azuresu.c1fba9900d4d.database.azure.com\" method=cert
(/datadrive/pg/data/pg_hba.conf:17)
2025-02-28 14:39:36 UTC-67c1caa8.5146-LOG:  connection authorized:
user=azuresu database=postgres SSL enabled (protocol=TLSv1.3,
cipher=TLS_AES_256_GCM_SHA384, bits=256)

I do not see any logs related to my unsuccessful tries.

In the "Server parameters" I have set the parameters:

log_connections ON
log_hostname ON
log_statement MOD
max_connections 500
ssl ON (cannot change that one)
listen_address '*' (cannot change that one)

And currently I am stuck, wonder how do others debug such problems?

Best regards
Alex

--00000000000084107e062f34f593
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div di=
r=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">Good afternoon=
,<br><br>I am using an=C2=A0Azure Database for PostgreSQL flexible server w=
ith no public ip.<br><br>It is connected to a private VNet and I try to acc=
ess it from an Alpine Linux container with openssl and postgresql-client in=
stalled.<br><br>In Azure portal I have clicked the &quot;Reset password&quo=
t; button, entered twice=C2=A0password12345!! and received the web browser =
notification</div><div>&quot;Successfully reset the password for postgresql=
&quot;<br><br>Then I run the commands:<br><br><div>$ openssl s_client -conn=
ect <a href=3D"http://172.21.32.4:5432">172.21.32.4:5432</a> -starttls post=
gres <br>(then after some time)</div><div>2C820000:error:8000274C:system li=
brary:BIO_connect:Unknown error:../openssl-3.2.3/crypto/bio/bio_sock2.c:178=
:calling connect()</div><div>2C820000:error:10000067:BIO routines:BIO_conne=
ct:connect error:../openssl-3.2.3/crypto/bio/bio_sock2.c:180:</div><div>con=
nect:errno=3D0</div></div><div><br><div>$ PGPASSWORD=3D&quot;password12345!=
!&quot; psql &quot;postgresql://postgres:password12345!!@<a href=3D"http://=
172.21.32.4:5432/postgres?sslmode=3Drequire">172.21.32.4:5432/postgres?sslm=
ode=3Drequire</a>&quot;</div><div>psql: error: connection to server at &quo=
t;172.21.32.4&quot;, port 5432 failed: FATAL:=C2=A0 password authentication=
 failed for user &quot;postgres&quot;</div></div><div><br>In the server log=
s I see entries for some other connections:<br><br><div>2025-02-28 14:39:35=
 UTC-67c1ca93.50ee-LOG:=C2=A0 disconnection: session time: 0:00:20.024 user=
=3Dazuresu database=3Dpostgres host=3D169.254.128.1 port=3D53076</div><div>=
2025-02-28 14:39:36 UTC-67c1caa8.5146-LOG:=C2=A0 connection received: host=
=3D169.254.128.1 port=3D49016</div><div>2025-02-28 14:39:36 UTC-67c1caa8.51=
46-LOG:=C2=A0 connection authenticated: identity=3D\&quot;CN=3D<a href=3D"h=
ttp://azuresu.c1fba9900d4d.database.azure.com">azuresu.c1fba9900d4d.databas=
e.azure.com</a>\&quot; method=3Dcert (/datadrive/pg/data/pg_hba.conf:17)</d=
iv><div>2025-02-28 14:39:36 UTC-67c1caa8.5146-LOG:=C2=A0 connection authori=
zed: user=3Dazuresu database=3Dpostgres SSL enabled (protocol=3DTLSv1.3, ci=
pher=3DTLS_AES_256_GCM_SHA384, bits=3D256)</div><br>I do not see any logs r=
elated to my unsuccessful tries.<br><br>In the &quot;Server parameters&quot=
; I have set the parameters:<br><br>log_connections ON<br>log_hostname ON<b=
r>log_statement MOD<br>max_connections 500<br>ssl ON (cannot change that on=
e)<br>listen_address &#39;*&#39; (cannot change that one)<br><br>And curren=
tly I am stuck, wonder how do others debug such problems?<br><br>Best regar=
ds<br>Alex</div></div></div></div></div></div></div></div>

--00000000000084107e062f34f593--