Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kqAwu-0000HA-Of for pgsql-general@arkaria.postgresql.org; Fri, 18 Dec 2020 08:17:17 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kqAwt-0000p8-1k for pgsql-general@arkaria.postgresql.org; Fri, 18 Dec 2020 08:17:15 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kqAws-0000nx-DT for pgsql-general@lists.postgresql.org; Fri, 18 Dec 2020 08:17:14 +0000 Received: from smtpout1.smhi.se ([2001:67c:274:5501::30]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kqAwn-0001vi-JY for pgsql-general@postgresql.org; Fri, 18 Dec 2020 08:17:12 +0000 Received: from winserv744.ad.smhi.se (winserv744.ad.smhi.se [172.16.6.35]) by smtpout1.smhi.se (Postfix) with ESMTPS id 168701095089; Fri, 18 Dec 2020 08:17:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smhi.se; s=20180112; t=1608279424; bh=Mg0AdMM/jZGEgbT3XPSbxkIeKOViforu/gsnk4L6B/Q=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=PD8abh4trYbJy6kMOOR64e+dlS7VMlH5yuh+FAqIjDWYpa+RlXHSu6svgDZXCWkVW lvTCgLv8ugEBcPneRGeJSsu3ADlRB96li1oDUyxXLf4T4gzWoJRV/M9LTjg+kftBJ9 w08kMbvjyPQQ0rcaALQbjSkJib8hXMOsohzDBPT8= Received: from winserv744.ad.smhi.se (172.16.6.35) by winserv744.ad.smhi.se (172.16.6.35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Fri, 18 Dec 2020 09:17:03 +0100 Received: from winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b]) by winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b%9]) with mapi id 15.01.2106.006; Fri, 18 Dec 2020 09:17:03 +0100 From: Gustavsson Mikael To: Tom Lane CC: Magnus Hagander , Kyotaro Horiguchi , "pgsql-general@postgresql.org" , Svensson Peter Subject: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Thread-Topic: SV: SV: Problem with ssl and psql in Postgresql 13 Thread-Index: AQHW1ER+dWnFD/e9/0CWjk1hYinUxan65DcAgAAT2weAAE4KgIAAEwPs///2LoCAAB6Q7f//9RsAgAAS+1X///M6gAACMBNMACAAxLA= Date: Fri, 18 Dec 2020 08:17:03 +0000 Message-ID: References: <20201217.172938.170511532557914014.horikyota.ntt@gmail.com> <06191eae74d045e192a786a84a73ba53@smhi.se> <65644.1608214801@sss.pgh.pa.us> , <698125e1105644adaa27578bb37b18f6@smhi.se>,<89909.1608222331@sss.pgh.pa.us>,<61e2a65bbc2f47d297a6f3cdac2cc6cc@smhi.se> In-Reply-To: <61e2a65bbc2f47d297a6f3cdac2cc6cc@smhi.se> Accept-Language: sv-SE, en-US Content-Language: sv-SE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.122.0.145] Content-Type: multipart/alternative; boundary="_000_d3ab9042bce34aae85d323d69e3ee430smhise_" MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_d3ab9042bce34aae85d323d69e3ee430smhise_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, I did some more tests to try to narrow it down. For me it only added to the= confusion but maybe it tells you something. Test 1: I changed my pg_hba.conf from hostssl to host. Now I can connect but SSL is not used even if i use require. pgsql-13: $ /usr/pgsql-13/bin/psql -d postgres -Ukalle -hserver Password for user kalle: psql (13.1) Type "help" for help. postgres=3D> pgsql-13 with require: $ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Dserver sslm= ode=3Drequire" Password for user kalle: psql (13.1) Type "help" for help. postgres=3D> pgsql-11 for reference: $ /usr/pgsql-11/bin/psql -d postgres -Ukalle -hserver Password for user kalle: psql (11.10, server 13.1) WARNING: psql major version 11, server major version 13. Some psql features might not work. SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 25= 6, compression: off) Type "help" for help. postgres=3D> Test2: It works when i connect pgsql-13 client to a postgresql-11 server. So it=B4= s only the combination pgsql-13 client and postgresql-13 server that does n= ot work. $ /usr/pgsql-13/bin/psql -d postgres -Ukalle -hserver11 Password for user kalle: psql (13.1, server 11.10) SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 25= 6, compression: off) Type "help" for help. postgres=3D> KR Mikael Gustavsson, SMHI ________________________________ Fr=E5n: externaly-forwarded@smhi.se f=F6r Gus= tavsson Mikael Skickat: den 17 december 2020 17:33:13 Till: Tom Lane Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.org; Sv= ensson Peter =C4mne: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Here is the result. ldd /usr/pgsql-13/bin/psql linux-vdso.so.1 (0x00007ffd714d5000) libpq.so.5 =3D> /usr/pgsql-13/lib/libpq.so.5 (0x00007f2d1700a000) libpthread.so.0 =3D> /lib64/libpthread.so.0 (0x00007f2d16dea000) libreadline.so.7 =3D> /lib64/libreadline.so.7 (0x00007f2d16b9b000) libm.so.6 =3D> /lib64/libm.so.6 (0x00007f2d16819000) libc.so.6 =3D> /lib64/libc.so.6 (0x00007f2d16456000) libssl.so.1.1 =3D> /lib64/libssl.so.1.1 (0x00007f2d161c2000) libcrypto.so.1.1 =3D> /lib64/libcrypto.so.1.1 (0x00007f2d15cdc000) libgssapi_krb5.so.2 =3D> /lib64/libgssapi_krb5.so.2 (0x00007f2d15a87000) libldap_r-2.4.so.2 =3D> /lib64/libldap_r-2.4.so.2 (0x00007f2d15830000) /lib64/ld-linux-x86-64.so.2 (0x00007f2d1725b000) libtinfo.so.6 =3D> /lib64/libtinfo.so.6 (0x00007f2d15603000) libz.so.1 =3D> /lib64/libz.so.1 (0x00007f2d153ec000) libdl.so.2 =3D> /lib64/libdl.so.2 (0x00007f2d151e8000) libkrb5.so.3 =3D> /lib64/libkrb5.so.3 (0x00007f2d14eff000) libk5crypto.so.3 =3D> /lib64/libk5crypto.so.3 (0x00007f2d14ce8000) libcom_err.so.2 =3D> /lib64/libcom_err.so.2 (0x00007f2d14ae4000) libkrb5support.so.0 =3D> /lib64/libkrb5support.so.0 (0x00007f2d148d3000) libkeyutils.so.1 =3D> /lib64/libkeyutils.so.1 (0x00007f2d146cf000) libresolv.so.2 =3D> /lib64/libresolv.so.2 (0x00007f2d144b8000) liblber-2.4.so.2 =3D> /lib64/liblber-2.4.so.2 (0x00007f2d142a8000) libsasl2.so.3 =3D> /lib64/libsasl2.so.3 (0x00007f2d1408a000) libselinux.so.1 =3D> /lib64/libselinux.so.1 (0x00007f2d13e60000) libcrypt.so.1 =3D> /lib64/libcrypt.so.1 (0x00007f2d13c37000) libpcre2-8.so.0 =3D> /lib64/libpcre2-8.so.0 (0x00007f2d139b3000) ldd /usr/pgsql-13/lib/libpq.so.5 linux-vdso.so.1 (0x00007fff51f79000) libssl.so.1.1 =3D> /lib64/libssl.so.1.1 (0x00007f88432d1000) libcrypto.so.1.1 =3D> /lib64/libcrypto.so.1.1 (0x00007f8842deb000) libgssapi_krb5.so.2 =3D> /lib64/libgssapi_krb5.so.2 (0x00007f8842b96000) libldap_r-2.4.so.2 =3D> /lib64/libldap_r-2.4.so.2 (0x00007f884293f000) libpthread.so.0 =3D> /lib64/libpthread.so.0 (0x00007f884271f000) libc.so.6 =3D> /lib64/libc.so.6 (0x00007f884235c000) libz.so.1 =3D> /lib64/libz.so.1 (0x00007f8842145000) libdl.so.2 =3D> /lib64/libdl.so.2 (0x00007f8841f41000) libkrb5.so.3 =3D> /lib64/libkrb5.so.3 (0x00007f8841c58000) libk5crypto.so.3 =3D> /lib64/libk5crypto.so.3 (0x00007f8841a41000) libcom_err.so.2 =3D> /lib64/libcom_err.so.2 (0x00007f884183d000) libkrb5support.so.0 =3D> /lib64/libkrb5support.so.0 (0x00007f884162c000) libkeyutils.so.1 =3D> /lib64/libkeyutils.so.1 (0x00007f8841428000) libresolv.so.2 =3D> /lib64/libresolv.so.2 (0x00007f8841211000) liblber-2.4.so.2 =3D> /lib64/liblber-2.4.so.2 (0x00007f8841001000) libsasl2.so.3 =3D> /lib64/libsasl2.so.3 (0x00007f8840de3000) /lib64/ld-linux-x86-64.so.2 (0x00007f88437b6000) libselinux.so.1 =3D> /lib64/libselinux.so.1 (0x00007f8840bb9000) libcrypt.so.1 =3D> /lib64/libcrypt.so.1 (0x00007f8840990000) libpcre2-8.so.0 =3D> /lib64/libpcre2-8.so.0 (0x00007f884070c000) /Mikael ________________________________ Fr=E5n: Tom Lane Skickat: den 17 december 2020 17:25:31 Till: Gustavsson Mikael Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.org; Sv= ensson Peter =C4mne: Re: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael writes: > $ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Dserver ss= lmode=3Drequire" > psql: error: FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "= kalle", database "postgres", SSL off > FATAL: no pg_hba.conf entry for host "nn.nnn.n.nnn", user "kalle", datab= ase "postgres", SSL off It'd be useful to verify that that version of psql+libpq is actually built with ssl support. Try ldd /usr/pgsql-13/bin/psql and then repeat "ldd" on whichever libpq.so is mentioned in the output. regards, tom lane --_000_d3ab9042bce34aae85d323d69e3ee430smhise_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi, 

I did some more tests to try to narrow it down. For me it only added to = the confusion but maybe it tells you something.


Test 1:

I changed my pg_hba.conf from hostssl to = host.

Now I can connect but SSL is not used eve= n if i use require.


pgsql-13:

$ /usr/pgsql-13/bin/psql -d postgres -Ukalle -hserver
Password for user kalle: 
psql (13.1)
Type "help" for help.

postgres=3D>

It works when i connect pgsql-13 client to a postgresql-11 server. So it=B4= s only the combination pgsql-13 client and postgresql-13 server that d= oes not work.


$  /usr/pgsql-13/bin/psql -d postgres -Ukalle -hserver11
Password for user kalle: 
psql (13.1, server 11.10)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bit= s: 256, compression: off)
Type "help" for help.

postgres=3D>


KR Mikael Gustavsson, SMHI


Fr=E5n: externaly-forwarded= @smhi.se <externaly-forwarded@smhi.se> f=F6r Gustavsson Mikael <mi= kael.gustavsson@smhi.se>
Skickat: den 17 december 2020 17:33:13
Till: Tom Lane
Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.= org; Svensson Peter
=C4mne: SV: SV: SV: Problem with ssl and psql in Postgresql 13
 

Here is the result.

ldd /usr/pgsql-13/bin/psql
linux-vdso.so.1 (0x00007ffd714d= 5000)
libpq.so.5 =3D> /usr/pgsql-1= 3/lib/libpq.so.5 (0x00007f2d1700a000)
libpthread.so.0 =3D> /lib64/= libpthread.so.0 (0x00007f2d16dea000)
libreadline.so.7 =3D> /lib64= /libreadline.so.7 (0x00007f2d16b9b000)
libm.so.6 =3D> /lib64/libm.s= o.6 (0x00007f2d16819000)
libc.so.6 =3D> /lib64/libc.s= o.6 (0x00007f2d16456000)
libssl.so.1.1 =3D> /lib64/li= bssl.so.1.1 (0x00007f2d161c2000)
libcrypto.so.1.1 =3D> /lib64= /libcrypto.so.1.1 (0x00007f2d15cdc000)
libgssapi_krb5.so.2 =3D> /li= b64/libgssapi_krb5.so.2 (0x00007f2d15a87000)
libldap_r-2.4.so.2 =3D> /lib= 64/libldap_r-2.4.so.2 (0x00007f2d15830000)
/lib64/ld-linux-x86-64.so.2 (0x= 00007f2d1725b000)
libtinfo.so.6 =3D> /lib64/li= btinfo.so.6 (0x00007f2d15603000)
libz.so.1 =3D> /lib64/libz.s= o.1 (0x00007f2d153ec000)
libdl.so.2 =3D> /lib64/libdl= .so.2 (0x00007f2d151e8000)
libkrb5.so.3 =3D> /lib64/lib= krb5.so.3 (0x00007f2d14eff000)
libk5crypto.so.3 =3D> /lib64= /libk5crypto.so.3 (0x00007f2d14ce8000)
libcom_err.so.2 =3D> /lib64/= libcom_err.so.2 (0x00007f2d14ae4000)
libkrb5support.so.0 =3D> /li= b64/libkrb5support.so.0 (0x00007f2d148d3000)
libkeyutils.so.1 =3D> /lib64= /libkeyutils.so.1 (0x00007f2d146cf000)
libresolv.so.2 =3D> /lib64/l= ibresolv.so.2 (0x00007f2d144b8000)
liblber-2.4.so.2 =3D> /lib64= /liblber-2.4.so.2 (0x00007f2d142a8000)
libsasl2.so.3 =3D> /lib64/li= bsasl2.so.3 (0x00007f2d1408a000)
libselinux.so.1 =3D> /lib64/= libselinux.so.1 (0x00007f2d13e60000)
libcrypt.so.1 =3D> /lib64/li= bcrypt.so.1 (0x00007f2d13c37000)
libpcre2-8.so.0 =3D> /lib64/= libpcre2-8.so.0 (0x00007f2d139b3000)

ldd /usr/pgsql-13/lib/libpq.so.5
linux-vdso.so.1 (0x00007fff51f7= 9000)
libssl.so.1.1 =3D> /lib64/li= bssl.so.1.1 (0x00007f88432d1000)
libcrypto.so.1.1 =3D> /lib64= /libcrypto.so.1.1 (0x00007f8842deb000)
libgssapi_krb5.so.2 =3D> /li= b64/libgssapi_krb5.so.2 (0x00007f8842b96000)
libldap_r-2.4.so.2 =3D> /lib= 64/libldap_r-2.4.so.2 (0x00007f884293f000)
libpthread.so.0 =3D> /lib64/= libpthread.so.0 (0x00007f884271f000)
libc.so.6 =3D> /lib64/libc.s= o.6 (0x00007f884235c000)
libz.so.1 =3D> /lib64/libz.s= o.1 (0x00007f8842145000)
libdl.so.2 =3D> /lib64/libdl= .so.2 (0x00007f8841f41000)
libkrb5.so.3 =3D> /lib64/lib= krb5.so.3 (0x00007f8841c58000)
libk5crypto.so.3 =3D> /lib64= /libk5crypto.so.3 (0x00007f8841a41000)
libcom_err.so.2 =3D> /lib64/= libcom_err.so.2 (0x00007f884183d000)
libkrb5support.so.0 =3D> /li= b64/libkrb5support.so.0 (0x00007f884162c000)
libkeyutils.so.1 =3D> /lib64= /libkeyutils.so.1 (0x00007f8841428000)
libresolv.so.2 =3D> /lib64/l= ibresolv.so.2 (0x00007f8841211000)
liblber-2.4.so.2 =3D> /lib64= /liblber-2.4.so.2 (0x00007f8841001000)
libsasl2.so.3 =3D> /lib64/li= bsasl2.so.3 (0x00007f8840de3000)
/lib64/ld-linux-x86-64.so.2 (0x= 00007f88437b6000)
libselinux.so.1 =3D> /lib64/= libselinux.so.1 (0x00007f8840bb9000)
libcrypt.so.1 =3D> /lib64/li= bcrypt.so.1 (0x00007f8840990000)
libpcre2-8.so.0 =3D> /lib64/= libpcre2-8.so.0 (0x00007f884070c000)

/Mikael

Fr=E5n: Tom Lane <tgl@= sss.pgh.pa.us>
Skickat: den 17 december 2020 17:25:31
Till: Gustavsson Mikael
Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.= org; Svensson Peter
=C4mne: Re: SV: SV: Problem with ssl and psql in Postgresql 13
 
Gustavsson Mikael <mikael.gustavsson@smhi.se>= ; writes:
> $ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Ds= erver sslmode=3Drequire"
> psql: error: FATAL:  no pg_hba.conf entry for host "nn.nnn.n= .nnn", user "kalle", database "postgres", SSL off<= br> > FATAL:  no pg_hba.conf entry for host "nn.nnn.n.nnn", u= ser "kalle", database "postgres", SSL off

It'd be useful to verify that that version of psql+libpq is actually built with ssl support.  Try

ldd /usr/pgsql-13/bin/psql

and then repeat "ldd" on whichever libpq.so is mentioned in the o= utput.

            &nb= sp;           regards, to= m lane
--_000_d3ab9042bce34aae85d323d69e3ee430smhise_--