Re: configuring openssl for postgres 9.2 for the first time

[Mark Steben <mark.steben@xxxxxxxxxxxxxxxxx>]

Hi Ray,

I just tried your suggestion:
  hostssl  all                all          0.0.0.0/0        

     md5 clientcert=1

and got the same error:
  no pg_hba.conf entry for host "10.10.4.34", user "postgres", database "marktst", SSL off

perhaps if I can get some insight as to how to determine what sslmode,  (if any) my client

is subscribed to, then I can follow through further with Ray's recommendation.

thanks for any help,

On Fri, Jan 31, 2014 at 5:48 PM, Ray Stell <stellr@xxxxxx> wrote:

On Jan 30, 2014, at 2:00 PM, Mark Steben <mark.steben@xxxxxxxxxxxxxxxxx> wrote:

Hello,

We are looking to provide openssl methodology into our testing environment.  I've run into this issue

when attempting to access from a client to a remote postgres server after SSL configuration:

from client 10.10.4.34:
psql -U postgres marktst -h 10.10.4.52
psql: FATAL:  no pg_hba.conf entry for host "10.10.4.34", user "postgres", database "marktst", SSL off

You might back off from ssl, client authentication just to see what happens with:

hostssl  all                all          0.0.0.0/0             md5 clientcert=1

this will provide the client auth of the server and require a password auth for the client.  Hopefully that works first.  I've seen your msg and had some effect with the following env variable, but it's probably a long shot: 

"PGSSLMODE behaves the same as the sslmode"

http://www.postgresql.org/docs/9.3/static/libpq-envars.html

PGSSLMODE=verify-full will cause the client to verify that the CN on the server certificate matches the hostname of the server.  disable will only try a non-SSL connection which will not be compatible with the pg_hba config.

It is a bit of a fishing expedition.

--

Mark Steben
 Database Administrator
@utoRevenue | Autobase 
  CRM division of Dominion Dealer Solutions 
95D Ashley Ave.
West Springfield, MA 01089
t: 413.327-3045
f: 413.383-9567

www.fb.com/DominionDealerSolutions
www.twitter.com/DominionDealer
 www.drivedominion.com