pg.ddx.io pgsql-general@postgresql.org mailing list archive
help / color / mirror / Atom feedSV: SV: Problem with ssl and psql in Postgresql 13
4+ messages / 2 participants
[nested] [flat]
* SV: SV: Problem with ssl and psql in Postgresql 13
@ 2020-12-17 14:35 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:00 ` SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
0 siblings, 1 reply; 4+ messages in thread
From: Gustavsson Mikael @ 2020-12-17 14:35 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>; pgsql-general; Svensson Peter <peter.svensson@smhi.se>
Hi,
log_connections is on. The ERR message is correct, we do not have an entry for SSL off.
The question is why psql(13) is trying to connect without ssl?
2020-12-17T14:25:09.565566+00:00 server INFO [30-1] pgpid=2422778 pguser=[unknown] pghost=nnn.nn.n.nnn pgdb=[unknown] pgapp=[unknown] LOG: connection received: host=nnn.nn.n.nnn port=40112
2020-12-17T14:25:09.566411+00:00 server ERR [31-1] pgpid=2422778 pguser=kalle pghost=nnn.nn.n.nnn pgdb=postgres pgapp=[unknown] FATAL: no pg_hba.conf entry for host "nnn.nn.n.nnn", user "kalle", database "postgres", SSL off
KR
Mikael Gustavsson, SMHI
________________________________
Från: Tom Lane <tgl@sss.pgh.pa.us>
Skickat: den 17 december 2020 15:20:01
Till: Gustavsson Mikael
Kopia: Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
Ämne: Re: SV: Problem with ssl and psql in Postgresql 13
Gustavsson Mikael <mikael.gustavsson@smhi.se> writes:
> Clarification, its the same postgresql13 server. I just connect with different psql-clients.
Perhaps turning on log_connections on the server would offer some
insight. It sort of looks like the v13 client is trying to connect
with SSL, failing for some unknown reason, and falling back to non-SSL
which also fails.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* SV: SV: Problem with ssl and psql in Postgresql 13
2020-12-17 14:35 SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
@ 2020-12-17 16:00 ` Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:19 ` SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
0 siblings, 1 reply; 4+ messages in thread
From: Gustavsson Mikael @ 2020-12-17 16:00 UTC (permalink / raw)
To: Magnus Hagander <magnus@hagander.net>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; Kyotaro Horiguchi <horikyota.ntt@gmail.com>; pgsql-general; Svensson Peter <peter.svensson@smhi.se>
Hi Magnus,
The clients 11 and 13 is on the same host.
Hmm, I get the same error if I set sslmode=require.
$ /usr/pgsql-13/bin/psql -d postgres --set=sslmode=require -Ukalle -hserver -W
Password:
psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
KR Mikael Gustavsson, SMHI
________________________________
Från: Magnus Hagander <magnus@hagander.net>
Skickat: den 17 december 2020 15:52:55
Till: Gustavsson Mikael
Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
Ämne: Re: SV: Problem with ssl and psql in Postgresql 13
On Thu, Dec 17, 2020 at 3:36 PM Gustavsson Mikael
<mikael.gustavsson@smhi.se> wrote:
>
>
> Hi,
>
> log_connections is on. The ERR message is correct, we do not have an entry for SSL off.
> The question is why psql(13) is trying to connect without ssl?
>
> 2020-12-17T14:25:09.565566+00:00 server INFO [30-1] pgpid=2422778 pguser=[unknown] pghost=nnn.nn.n.nnn pgdb=[unknown] pgapp=[unknown] LOG: connection received: host=nnn.nn.n.nnn port=40112
> 2020-12-17T14:25:09.566411+00:00 server ERR [31-1] pgpid=2422778 pguser=kalle pghost=nnn.nn.n.nnn pgdb=postgres pgapp=[unknown] FATAL: no pg_hba.conf entry for host "nnn.nn.n.nnn", user "kalle", database "postgres", SSL off
By default psql/libpq will fall back to a clear text connection if the
ssl encrypted one failed. Specify sslmode=require (or preferably
higher) in the connection string or set PGSSLMODE=require on the
client to disable that behavior. If you do that, my guess is you will
see a direct connection failure instead of that error?
PostgreSQL 13 did change the default value for minimum tls version to
1.2. But that seems unlikely to be the problem since you get TLS 1.3
when you use the old version...
I assume you're running both the 11 and the 13 client on the same host?
--
Magnus Hagander
Me: https://www.hagander.net/
Work: https://www.redpill-linpro.com/
^ permalink raw reply [nested|flat] 4+ messages in thread
* SV: SV: Problem with ssl and psql in Postgresql 13
2020-12-17 14:35 SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:00 ` SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
@ 2020-12-17 16:19 ` Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:25 ` Re: SV: SV: Problem with ssl and psql in Postgresql 13 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 4+ messages in thread
From: Gustavsson Mikael @ 2020-12-17 16:19 UTC (permalink / raw)
To: Magnus Hagander <magnus@hagander.net>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; Kyotaro Horiguchi <horikyota.ntt@gmail.com>; pgsql-general; Svensson Peter <peter.svensson@smhi.se>
Sorry, my bad. But i get the same result.
$ /usr/pgsql-13/bin/psql "dbname=postgres user=kalle host=server sslmode=require"
psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
/Mikael
________________________________
Från: Magnus Hagander <magnus@hagander.net>
Skickat: den 17 december 2020 17:03:18
Till: Gustavsson Mikael
Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
Ämne: Re: SV: Problem with ssl and psql in Postgresql 13
That's setting a variable, not a parameter.
You need something like
psql "dbname=postgres user=kalle host=server sslmode=require"
Or
PGSSLMODE=require /usr/bin/pgsql-same-as-you-had-before
//Magnus
On Thu, Dec 17, 2020 at 5:00 PM Gustavsson Mikael
<mikael.gustavsson@smhi.se> wrote:
>
> Hi Magnus,
>
>
> The clients 11 and 13 is on the same host.
>
>
> Hmm, I get the same error if I set sslmode=require.
>
>
> $ /usr/pgsql-13/bin/psql -d postgres --set=sslmode=require -Ukalle -hserver -W
> Password:
> psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
> FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
>
> KR Mikael Gustavsson, SMHI
>
>
> ________________________________
> Från: Magnus Hagander <magnus@hagander.net>
> Skickat: den 17 december 2020 15:52:55
> Till: Gustavsson Mikael
> Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
> Ämne: Re: SV: Problem with ssl and psql in Postgresql 13
>
> On Thu, Dec 17, 2020 at 3:36 PM Gustavsson Mikael
> <mikael.gustavsson@smhi.se> wrote:
> >
> >
> > Hi,
> >
> > log_connections is on. The ERR message is correct, we do not have an entry for SSL off.
> > The question is why psql(13) is trying to connect without ssl?
> >
> > 2020-12-17T14:25:09.565566+00:00 server INFO [30-1] pgpid=2422778 pguser=[unknown] pghost=nnn.nn.n.nnn pgdb=[unknown] pgapp=[unknown] LOG: connection received: host=nnn.nn.n.nnn port=40112
> > 2020-12-17T14:25:09.566411+00:00 server ERR [31-1] pgpid=2422778 pguser=kalle pghost=nnn.nn.n.nnn pgdb=postgres pgapp=[unknown] FATAL: no pg_hba.conf entry for host "nnn.nn.n.nnn", user "kalle", database "postgres", SSL off
>
>
> By default psql/libpq will fall back to a clear text connection if the
> ssl encrypted one failed. Specify sslmode=require (or preferably
> higher) in the connection string or set PGSSLMODE=require on the
> client to disable that behavior. If you do that, my guess is you will
> see a direct connection failure instead of that error?
>
> PostgreSQL 13 did change the default value for minimum tls version to
> 1.2. But that seems unlikely to be the problem since you get TLS 1.3
> when you use the old version...
>
> I assume you're running both the 11 and the 13 client on the same host?
--
Magnus Hagander
Me: https://www.hagander.net/
Work: https://www.redpill-linpro.com/
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: SV: SV: Problem with ssl and psql in Postgresql 13
2020-12-17 14:35 SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:00 ` SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:19 ` SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
@ 2020-12-17 16:25 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 4+ messages in thread
From: Tom Lane @ 2020-12-17 16:25 UTC (permalink / raw)
To: Gustavsson Mikael <mikael.gustavsson@smhi.se>; +Cc: Magnus Hagander <magnus@hagander.net>; Kyotaro Horiguchi <horikyota.ntt@gmail.com>; pgsql-general; Svensson Peter <peter.svensson@smhi.se>
Gustavsson Mikael <mikael.gustavsson@smhi.se> writes:
> $ /usr/pgsql-13/bin/psql "dbname=postgres user=kalle host=server sslmode=require"
> psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
> FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", database "postgres", SSL off
It'd be useful to verify that that version of psql+libpq is actually
built with ssl support. Try
ldd /usr/pgsql-13/bin/psql
and then repeat "ldd" on whichever libpq.so is mentioned in the output.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2020-12-17 16:25 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-12-17 14:35 SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:00 ` Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:19 ` Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-17 16:25 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox