Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpvi8-0003qo-7C for pgsql-general@arkaria.postgresql.org; Thu, 17 Dec 2020 16:01:00 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kpvi6-0003UH-LF for pgsql-general@arkaria.postgresql.org; Thu, 17 Dec 2020 16:00:58 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpvi6-0003U9-8m for pgsql-general@lists.postgresql.org; Thu, 17 Dec 2020 16:00:58 +0000 Received: from smtpout2.smhi.se ([2001:67c:274:5501::39]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpvi2-0007v9-3e for pgsql-general@postgresql.org; Thu, 17 Dec 2020 16:00:57 +0000 Received: from winserv743.ad.smhi.se (winserv743.ad.smhi.se [172.16.6.38]) by smtpout2.smhi.se (Postfix) with ESMTPS id 64EB810A7EEB; Thu, 17 Dec 2020 16:00:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smhi.se; s=20180112; t=1608220850; bh=wqnZ77tqSwWFFspPydITdmIUcxe1hEfCWKknU42LcuM=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=OelCCSwFBncHqnVxuPjQF+v2/ZOTPtoLL6J+y1wc2COdJLBHJDbgzIFFSo4xYFDku DTtL40V7Skuz/EAX7n5lzsiybU0CtYMe0gfYmCrgpNztfKU5NjpRD2laJX940ExMoG x1Up5EUemoFVZFnf/q/UC/zB6H4Nl3wvU1ZkAk0g= Received: from winserv744.ad.smhi.se (172.16.6.35) by winserv743.ad.smhi.se (172.16.6.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Thu, 17 Dec 2020 17:00:50 +0100 Received: from winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b]) by winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b%9]) with mapi id 15.01.2106.006; Thu, 17 Dec 2020 17:00:50 +0100 From: Gustavsson Mikael To: Magnus Hagander CC: Tom Lane , Kyotaro Horiguchi , "pgsql-general@postgresql.org" , Svensson Peter Subject: SV: SV: Problem with ssl and psql in Postgresql 13 Thread-Topic: SV: Problem with ssl and psql in Postgresql 13 Thread-Index: AQHW1ER+dWnFD/e9/0CWjk1hYinUxan65DcAgAAT2weAAE4KgIAAEwPs///2LoCAAB6Q7Q== Date: Thu, 17 Dec 2020 16:00:50 +0000 Message-ID: References: <20201217.172938.170511532557914014.horikyota.ntt@gmail.com> <06191eae74d045e192a786a84a73ba53@smhi.se> <65644.1608214801@sss.pgh.pa.us> , In-Reply-To: Accept-Language: sv-SE, en-US Content-Language: sv-SE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.122.0.145] Content-Type: multipart/alternative; boundary="_000_a9e6ef756df24fba948b5c09b1f30229smhise_" MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_a9e6ef756df24fba948b5c09b1f30229smhise_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Magnus, The clients 11 and 13 is on the same host. Hmm, I get the same error if I set sslmode=3Drequire. $ /usr/pgsql-13/bin/psql -d postgres --set=3Dsslmode=3Drequire -Ukalle -hse= rver -W Password: psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "ka= lle", database "postgres", SSL off FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", databas= e "postgres", SSL off KR Mikael Gustavsson, SMHI ________________________________ Fr=E5n: Magnus Hagander Skickat: den 17 december 2020 15:52:55 Till: Gustavsson Mikael Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson = Peter =C4mne: Re: SV: Problem with ssl and psql in Postgresql 13 On Thu, Dec 17, 2020 at 3:36 PM Gustavsson Mikael wrote: > > > Hi, > > log_connections is on. The ERR message is correct, we do not have an entr= y for SSL off. > The question is why psql(13) is trying to connect without ssl? > > 2020-12-17T14:25:09.565566+00:00 server INFO [30-1] pgpid=3D2422778 pguse= r=3D[unknown] pghost=3Dnnn.nn.n.nnn pgdb=3D[unknown] pgapp=3D[unknown] LOG:= connection received: host=3Dnnn.nn.n.nnn port=3D40112 > 2020-12-17T14:25:09.566411+00:00 server ERR [31-1] pgpid=3D2422778 pguser= =3Dkalle pghost=3Dnnn.nn.n.nnn pgdb=3Dpostgres pgapp=3D[unknown] FATAL: no= pg_hba.conf entry for host "nnn.nn.n.nnn", user "kalle", database "postgre= s", SSL off By default psql/libpq will fall back to a clear text connection if the ssl encrypted one failed. Specify sslmode=3Drequire (or preferably higher) in the connection string or set PGSSLMODE=3Drequire on the client to disable that behavior. If you do that, my guess is you will see a direct connection failure instead of that error? PostgreSQL 13 did change the default value for minimum tls version to 1.2. But that seems unlikely to be the problem since you get TLS 1.3 when you use the old version... I assume you're running both the 11 and the 13 client on the same host? -- Magnus Hagander Me: https://www.hagander.net/ Work: https://www.redpill-linpro.com/ --_000_a9e6ef756df24fba948b5c09b1f30229smhise_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi Magnus,


The clients 11 and 13 is on the same host.


Hmm, I get the same error if I set sslmode=3Drequire.


$ /usr/pgsql-13/bin/psql -d postgres --set=3Dsslmode=3Drequire -Ukalle= -hserver -W 
Password: 
psql: error: FATAL:  no pg_hba.conf entry for host "nn.nnn.n= .nnn", user "kalle", database "postgres", SSL off<= /div>
FATAL:  no pg_hba.conf entry for host "nn.nnn.n.nnn", u= ser "kalle", database "postgres", SSL off

KR Mikael Gustavsson, SMHI


Fr=E5n: Magnus Hagander &= lt;magnus@hagander.net>
Skickat: den 17 december 2020 15:52:55
Till: Gustavsson Mikael
Kopia: Tom Lane; Kyotaro Horiguchi; pgsql-general@postgresql.org; Sv= ensson Peter
=C4mne: Re: SV: Problem with ssl and psql in Postgresql 13
 
On Thu, Dec 17, 2020 at 3:36 PM Gustavsson Mikael<= br> <mikael.gustavsson@smhi.se> wrote:
>
>
> Hi,
>
> log_connections is on. The ERR message is correct, we do not have an e= ntry for SSL off.
> The question is why psql(13) is trying to connect without ssl?
>
> 2020-12-17T14:25:09.565566+00:00 server INFO [30-1] pgpid=3D242277= 8 pguser=3D[unknown] pghost=3Dnnn.nn.n.nnn pgdb=3D[unknown] pgapp=3D[unknow= n] LOG:  connection received: host=3Dnnn.nn.n.nnn port=3D40112
> 2020-12-17T14:25:09.566411+00:00 server ERR [31-1] pgpid=3D2422778= pguser=3Dkalle pghost=3Dnnn.nn.n.nnn pgdb=3Dpostgres pgapp=3D[unknown] FAT= AL:  no pg_hba.conf entry for host "nnn.nn.n.nnn", user &quo= t;kalle", database "postgres", SSL off


By default psql/libpq will fall back to a clear text connection if the
ssl encrypted one failed. Specify sslmode=3Drequire (or preferably
higher) in the connection string or set PGSSLMODE=3Drequire on the
client to disable that behavior. If you do that, my guess is you will
see a direct connection failure instead of that error?

PostgreSQL 13 did change the default value for minimum tls version to
1.2. But that seems unlikely to be the problem since you get TLS 1.3
when you use the old version...

I assume you're running both the 11 and the 13 client on the same host?

--
 Magnus Hagander
 Me: https://www.hagander.net/
 Work: https://www.redpill= -linpro.com/
 --_000_a9e6ef756df24fba948b5c09b1f30229smhise_--