DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com;
	h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type;
	b=KXoDIs80NaxMJJrvNm5nhAAic3JiKKNWMtjGBjFknIUVR9sQLsKdXq0eQPe4Ue1/N/cs+OgdU2himvIc7mGyaxzwjOsA0mxzrTYFtw1XBIWZPyT58bf7q8rUzjx0p0vcXjXtSrGSIfsDEouNruHrQPJ9G+zv48IT4cK55FNsKgU=;
References: <515AEB4E.9010305@europecamions-interactive.com>
	<CALxYTP6sxtHSwfFk2C3n4cV59NNPcg2Po9R04SM8W9WTR1ThWw@mail.gmail.com>
	<1365617192.69337.YahooMailNeo@web163506.mail.gq1.yahoo.com>
	<20130410181656.GB32580@aart.rice.edu>
	<1367943441337-5754606.post@n5.nabble.com>
Message-ID: <1367946428.1661.YahooMailNeo@web163503.mail.gq1.yahoo.com>
Date: Tue, 7 May 2013 10:07:08 -0700 (PDT)
From: Bhanu Murthy <bhanu_murthy@yahoo.com>
Reply-To: Bhanu Murthy <bhanu_murthy@yahoo.com>
Subject: Re: [SQL] Encrypting PGBouncer to Postgres DB connections
To: handsfree <luke.hansbury@redwood.com>,
	"pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
In-Reply-To: <1367943441337-5754606.post@n5.nabble.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="48240482-1519852437-1367946428=:1661"
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

--48240482-1519852437-1367946428=:1661
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Here is my understading of your requirement:=0A=A0=0Amachine-A at customer =
site would replicate to staging machine-B which will then replicate to targ=
et machine-C in cloud - and you would want to encrypt data in motion from A=
 to B to C.=0A=A0=0AI could think of 2 possible solutions:=0A=A0=0A1. Use S=
tunnel from machine-A to machine-B, and again from machine-B to machine-C. =
=0A=A0=0A=A0=0A2. Use streaming replication config features to secure traff=
ic (encrypted=A0data over=A0TCP)=0A=A0=0AMaster configuration on machine-A:=
=0A=3D>Update=A0replication line in pg_hba.conf=A0to "hostssl"=0A=0ASlave c=
onfiguration on machine-B:=0A=3D> primary_conninfo=3D'host=3Dmachine-A port=
=3D5432 sslmode=3Drequire' =0Aor=0A=3D> primary_conninfo=3D'host=3Dmachine-=
A port=3D5432 sslmode=3Dverify-ca'=0A=A0=0AYou could then use cascading rep=
lication (available from postgres 9.2) from machine-B to machine-C.=0A=A0 =
=0A=0A________________________________=0A From: handsfree <luke.hansbury@re=
dwood.com>=0ATo: pgsql-admin@postgresql.org =0ASent: Tuesday, May 7, 2013 9=
:17 AM=0ASubject: Re: [ADMIN] [SQL] Encrypting PGBouncer to Postgres DB con=
nections=0A  =0A=0AWe're looking to use streaming replication to a target v=
ia a secondary host=0Ausing stunnel.=A0 I'd love to hear how you were able =
to achieve this,=0Aktm@rice.edu.=0A=0AEffectively we're looking to have the=
 database on our customer's site (let's=0Acall that MachineA) replicate to =
our backend postgres target in the cloud=0A(let's call that MachineC).=A0 H=
owever, MachineA has no direct communication=0Awith MachineC, in fact, it s=
hould never be allowed to communicate with it. =0AWe have another server th=
at provides various services to the client MachineA=0Athat is based in our =
home datacenter (let's call that MachineB) which we=0Awould like to use as =
a 'staging' machine for the replication to the database=0Areplication targe=
t.=A0 Is this possible to achieve using stunnel (and=0Apgbouncer?) alone?=
=A0 =0A=0AAt no point can this traffic go 'in the clear', for obvious reaso=
ns ;)=0A=0AAny pointers or assistance help gratefully received!=A0 Thanks=
=0A=0A=0A=0A--=0AView this message in context: http://postgresql.1045698.n5=
.nabble.com/Hot-standby-with-streaming-replication-under-PgSQL-9-1-x-failov=
er-when-master-crashes-tp5750442p5754606.html=0ASent from the PostgreSQL - =
admin mailing list archive at Nabble.com.=0A=0A=0A-- =0ASent via pgsql-admi=
n mailing list (pgsql-admin@postgresql.org)=0ATo make changes to your subsc=
ription:=0Ahttp://www.postgresql.org/mailpref/pgsql-admin
--48240482-1519852437-1367946428=:1661
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<html><body><div style=3D"color:#000; background-color:#fff; font-family:ve=
rdana, helvetica, sans-serif;font-size:14pt"><div><span>Here is my understa=
ding of your requirement:</span></div><div><span></span>&nbsp;</div><div><s=
pan>machine-A at customer site would replicate to staging machine-B which w=
ill then replicate to target machine-C in cloud - and you would want to enc=
rypt data in motion from A to B to C.</span></div><div><span></span>&nbsp;<=
/div><div><span>I could think of 2 possible solutions:</span></div><div><sp=
an></span>&nbsp;</div><div><span>1. Use Stunnel from machine-A to machine-B=
, and again from machine-B to machine-C. </span></div><div><span></span>&nb=
sp;</div><div><span></span>&nbsp;</div><div><span>2. Use streaming replicat=
ion config features to secure traffic (encrypted&nbsp;data over&nbsp;TCP)</=
span></div><div><span></span>&nbsp;</div><div><span><u>Master configuration=
 on machine-A:</u></span></div><div><span>=3D&gt;Update&nbsp;replication
 line in pg_hba.conf&nbsp;to "hostssl"<br></span><span></span></div><div><s=
pan><u>Slave configuration on machine-B:</u></span></div><div><span>=3D&gt;=
 primary_conninfo=3D'host=3Dmachine-A port=3D5432 sslmode=3Drequire' </span=
></div><div><span>or<br>=3D&gt; primary_conninfo=3D'host=3Dmachine-A port=
=3D5432 sslmode=3Dverify-ca'</span></div><div><span></span>&nbsp;</div><div=
><span>You could then use cascading replication (available from postgres 9.=
2) from machine-B to machine-C.</span><br></div>&nbsp; <div style=3D"font-f=
amily: verdana, helvetica, sans-serif; font-size: 14pt;"> <div style=3D"fon=
t-family: times new roman, new york, times, serif; font-size: 12pt;"> <div =
dir=3D"ltr"> <div style=3D"margin: 5px 0px; padding: 0px; border: 1px solid=
 rgb(204, 204, 204); height: 0px; line-height: 0; font-size: 0px;" class=3D=
"hr" contentEditable=3D"false" readonly=3D"true"></div>  <font size=3D"2" f=
ace=3D"Arial"> <b><span style=3D"font-weight: bold;">From:</span></b> hands=
free
 &lt;luke.hansbury@redwood.com&gt;<br> <b><span style=3D"font-weight: bold;=
">To:</span></b> pgsql-admin@postgresql.org <br> <b><span style=3D"font-wei=
ght: bold;">Sent:</span></b> Tuesday, May 7, 2013 9:17 AM<br> <b><span styl=
e=3D"font-weight: bold;">Subject:</span></b> Re: [ADMIN] [SQL] Encrypting P=
GBouncer to Postgres DB connections<br> </font> </div> <div class=3D"y_msg_=
container"><br>=0AWe're looking to use streaming replication to a target vi=
a a secondary host<br>using stunnel.&nbsp; I'd love to hear how you were ab=
le to achieve this,<br><a href=3D"mailto:ktm@rice.edu" ymailto=3D"mailto:kt=
m@rice.edu">ktm@rice.edu</a>.<br><br>Effectively we're looking to have the =
database on our customer's site (let's<br>call that MachineA) replicate to =
our backend postgres target in the cloud<br>(let's call that MachineC).&nbs=
p; However, MachineA has no direct communication<br>with MachineC, in fact,=
 it should never be allowed to communicate with it. <br>We have another ser=
ver that provides various services to the client MachineA<br>that is based =
in our home datacenter (let's call that MachineB) which we<br>would like to=
 use as a 'staging' machine for the replication to the database<br>replicat=
ion target.&nbsp; Is this possible to achieve using stunnel (and<br>pgbounc=
er?) alone?&nbsp; <br><br>At no point can this traffic go 'in the clear', f=
or obvious
 reasons ;)<br><br>Any pointers or assistance help gratefully received!&nbs=
p; Thanks<br><br><br><br>--<br>View this message in context: http://postgre=
sql.1045698.n5.nabble.com/Hot-standby-with-streaming-replication-under-PgSQ=
L-9-1-x-failover-when-master-crashes-tp5750442p5754606.html<br>Sent from th=
e PostgreSQL - admin mailing list archive at <a href=3D"http://nabble.com/"=
 target=3D"_blank">Nabble.com</a>.<br><br><br>-- <br>Sent via pgsql-admin m=
ailing list (<a href=3D"mailto:pgsql-admin@postgresql.org" ymailto=3D"mailt=
o:pgsql-admin@postgresql.org">pgsql-admin@postgresql.org</a>)<br>To make ch=
anges to your subscription:<br>http://www.postgresql.org/mailpref/pgsql-adm=
in<br><br><br></div> </div> </div>  </div></body></html>
--48240482-1519852437-1367946428=:1661--