Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpnbA-00027l-S7 for pgsql-general@arkaria.postgresql.org; Thu, 17 Dec 2020 07:21:17 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kpnb9-0004iD-RS for pgsql-general@arkaria.postgresql.org; Thu, 17 Dec 2020 07:21:15 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpnb9-0004hB-ER for pgsql-general@lists.postgresql.org; Thu, 17 Dec 2020 07:21:15 +0000 Received: from smtpout1.smhi.se ([2001:67c:274:5501::30]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kpnb7-0001QV-Ot for pgsql-general@postgresql.org; Thu, 17 Dec 2020 07:21:14 +0000 Received: from winserv744.ad.smhi.se (winserv744.ad.smhi.se [172.16.6.35]) by smtpout1.smhi.se (Postfix) with ESMTPS id 27ABC1097E90 for ; Thu, 17 Dec 2020 07:21:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smhi.se; s=20180112; t=1608189669; bh=prIkOFym990pafD5wB8R8ejjM53Q+DOuMx4LV3GA4W0=; h=From:To:CC:Subject:Date:From; b=QUh33UVBzJBMUhSjh8YUn7kx7frSvTRCt6tODPtYxVfOrIBbY029hohpCGm4AT/u+ fMHdpRGGkUNOPxpygdgyZa8oa0NogXVdVFKryBsdLBlJEw0itPvSJkXmU8TKX25Gl4 3xUcWv6jLlDNdYCtfnlLi16UC0N++tXThxe2gasg= Received: from winserv744.ad.smhi.se (172.16.6.35) by winserv744.ad.smhi.se (172.16.6.35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Thu, 17 Dec 2020 08:21:08 +0100 Received: from winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b]) by winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b%9]) with mapi id 15.01.2106.006; Thu, 17 Dec 2020 08:21:08 +0100 From: Gustavsson Mikael To: "pgsql-general@postgresql.org" CC: Svensson Peter Subject: Problem with ssl and psql in Postgresql 13 Thread-Topic: Problem with ssl and psql in Postgresql 13 Thread-Index: AQHW1ER+dWnFD/e9/0CWjk1hYinUxQ== Date: Thu, 17 Dec 2020 07:21:08 +0000 Message-ID: Accept-Language: sv-SE, en-US Content-Language: sv-SE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.122.0.145] Content-Type: multipart/alternative; boundary="_000_e5b0b6ed05764324a2f3fe7acfc766d5smhise_" MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_e5b0b6ed05764324a2f3fe7acfc766d5smhise_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, We are starting our journey to migrate from Postgresql 11 to Postgresql 13 = and have run into a problem. The postgresql 13 version of psql don=B4t seem to work with ssl. We use the community built rpms on redhat 8.3: $ rpm -q postgresql11 postgresql11-11.10-1PGDG.rhel8.x86_64 $ rpm -q postgresql13 postgresql13-13.1-1PGDG.rhel8.x86_64 Is there some configuration we have missed that have changed between Postgr= esql 11 and 13? Here is an example, sorry for the obfuscations. It works as expected from psql 11: $ psql -d postgres -Ukalle -hserver -W Password: psql (11.10, server 13.1) WARNING: psql major version 11, server major version 13. Some psql features might not work. SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 25= 6, compression: off) Type "help" for help. postgres=3D> But not from psql 13: $ /usr/pgsql-13/bin/psql -d postgres -Ukalle -hserver -W Password: psql: error: FATAL: no pg_hba.conf entry for host "nnn.nn.n.nnn", user "ka= lle", database "postgres", SSL off FATAL: no pg_hba.conf entry for host "nnn.nn.n.nnn", user "kalle", databas= e "postgres", SSL off Our mean all-ssl test pg_hba.conf file: # TYPE DATABASE USER ADDRESS METHOD # "local" is for Unix domain socket connections only local all all reject # IPv4 local connections: hostssl all all 0.0.0.0/0 pam # IPv6 local connections: #host all all ::1/128 reject # Allow replication connections from localhost, by a user with the # replication privilege. #host replication postgres reject Kind Regards Mikael Gustavsson, SMHI - Swedish Meteorological and Hydrological Institute --_000_e5b0b6ed05764324a2f3fe7acfc766d5smhise_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi, 
We are starting our journey to migrate from Postgresql 11 to Postgresq= l 13 and have run into a problem.

The postgresql 13 version of psql don=B4t seem to work with = ssl. 
We use the community built rpms on re= dhat 8.3:
<= br>
$= rpm -q postgresql11
p= ostgresql11-11.10-1PGDG.rhel8.x86_64
<= br>
$= rpm -q postgresql13
postgresql13-13.1-1PGDG.rhel8.x86_64

Is there some config= uration we have missed that have changed between Postgresql 11 and 13?

Here is an example, sorry for the obfuscations.

It works as expected from psql 11:
$ psql -d postgres -= Ukalle -hserver -W
Password: 
psql (11.10, server 13.1)
WARNING: psql major version 11, server major version 13.
         Some psql features might not work.
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bit= s: 256, compression: off)
Type "help" for help.

postgres=3D>

But not from psql 13:
$ /usr/pgsql-13/bin/psql -d postgres -Ukalle -hserver -W
Password: 
psql: error: FATAL:  no pg_hba.conf entry for host "nnn.nn.n= .nnn", user "kalle", database "postgres", SSL off<= /div>
FATAL:  no pg_hba.conf entry for host "nnn.nn.n.nnn", u= ser "kalle", database "postgres", SSL off


Our mean all-ssl test pg_hba.conf file:
# TYPE  DATABASE        USER&n= bsp;           ADDRESS&nb= sp;            =     METHOD

# "local" is for Unix domain socket connections only
local   all         =     all         = ;            &n= bsp;            = ;   reject
# IPv4 local connections:
hostssl all          &nbs= p;  all          &nb= sp;  0.0.0.0/0         &n= bsp;      pam
# IPv6 local connections:
#host   all         =     all         = ;     ::1/128       =           reject
# Allow replication connections from localhost, by a user with the
# replication privilege.
#host    replication      &nbs= p;   postgres        &nbs= p;            &= nbsp;         reject

 
Kind Regards 
Mikael Gustavsson, SMHI - Swedish Meteorological and Hydrological Institute

--_000_e5b0b6ed05764324a2f3fe7acfc766d5smhise_--