public inbox for [email protected]
help / color / mirror / Atom feedRe: How to configure client-side TLS ciphers for streaming replication?
2+ messages / 2 participants
[nested] [flat]
* Re: How to configure client-side TLS ciphers for streaming replication?
@ 2025-08-26 20:16 Laurenz Albe <[email protected]>
2025-08-27 19:59 ` Re: How to configure client-side TLS ciphers for streaming replication? Daniel Gustafsson <[email protected]>
0 siblings, 1 reply; 2+ messages in thread
From: Laurenz Albe @ 2025-08-26 20:16 UTC (permalink / raw)
To: xx Z <[email protected]>; +Cc: [email protected]
On Tue, 2025-08-26 at 20:34 +0800, xx Z wrote:
> Thanks for your suggestion.
> But I still want to know why we can't set "ssl_ciphers" on the client side.
I'd say because nobody implemented it, perhaps because nobody felt the need.
> This is still considered a security issue in some cases, and PostgreSQL has
> mature capabilities on the master side to implement this functionality.
That sounds to me like some moderately clueful security auditor is looking
for a nit to pick. If you do streaming replication, and you control the
ciphers on the primary server, what added security benefit do you get by
controlling the ciphers on the standby server (the client) as well?
Yours,
Laurenz Albe
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: How to configure client-side TLS ciphers for streaming replication?
2025-08-26 20:16 Re: How to configure client-side TLS ciphers for streaming replication? Laurenz Albe <[email protected]>
@ 2025-08-27 19:59 ` Daniel Gustafsson <[email protected]>
0 siblings, 0 replies; 2+ messages in thread
From: Daniel Gustafsson @ 2025-08-27 19:59 UTC (permalink / raw)
To: Laurenz Albe <[email protected]>; +Cc: xx Z <[email protected]>; [email protected]
> On 26 Aug 2025, at 22:16, Laurenz Albe <[email protected]> wrote:
>
> On Tue, 2025-08-26 at 20:34 +0800, xx Z wrote:
>> Thanks for your suggestion.
>> But I still want to know why we can't set "ssl_ciphers" on the client side.
>
> I'd say because nobody implemented it, perhaps because nobody felt the need.
I think the former is a highly likely suspect here.
>> This is still considered a security issue in some cases, and PostgreSQL has
>> mature capabilities on the master side to implement this functionality.
>
> That sounds to me like some moderately clueful security auditor is looking
> for a nit to pick. If you do streaming replication, and you control the
> ciphers on the primary server, what added security benefit do you get by
> controlling the ciphers on the standby server (the client) as well?
I would place this above nitpicking, but I also don't have a clear idea of an
attack (if I did I'd fix it..). TLS is riddled with weird cases involving
network middleboxes (usually very enterprisy) so insisting on control isn't
necessarily a bad thing.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2025-08-27 19:59 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-08-26 20:16 Re: How to configure client-side TLS ciphers for streaming replication? Laurenz Albe <[email protected]>
2025-08-27 19:59 ` Daniel Gustafsson <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox