如何使用 ssl 选项确保 npgsql 连接的安全

Question

i use npgsql version 2270 and i would to secure my connection passing db password NOT in cleartext and with capability to use SSL connection on a preconfigured postgresql server. My doubt is about how set the connection string with npgsql.

I tryed adding ssl=true sslmode=prefer to conn string but i have not idea about how to verify if it work.
Is sufficient for secure data transit? is string correct?
Is needed to activate ssl also on server is right?
How can i verify if data transit on ssl mode ? Thanks all.

Answer 1

First, SSL isn't really about encrypting your password - it's about encrypting the entire stream. If you use PostgreSQL's md5 authentication method (see your pg_hba.conf), then passwords are never transferred in cleartext regardless of whether you're using SSL or not.

To use SSL, it's better to set SSL Mode to require rather than prefer : the latter will attempt to establish an SSL connection, but will fallback to non-SSL if the server doesn't support it. require will fail the connection attempt if SSL could not be established.

Regardless, yes, you need to set up SSL on PostgreSQL, including a certificate and a private key - you can read about this in the documentation .

If the aim is only to avoid sending passwords in cleartext, using md5 (or sha256 in more recent versions) is the simplest way.