[英]How to enforce client to use SSL for postgresql?
Environment:环境:
Windows 10, localhost, same machine
pg 12
node 14
openssl 1.1.1k
I've read and done pg docs starting from this .我从this开始阅读并完成了 pg 文档。
postgresql.conf (in C:\Program Files\PostgreSQL\12\data, my understanding is it controls pg DB server) postgresql.conf (在 C:\Program Files\PostgreSQL\12\data 中,我的理解是它控制 pg DB 服务器)
ssl = on # per pg doc: server will listen for both normal and SSL connections on the same TCP port, and will negotiate with any connecting client on whether to use SSL
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'
ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
ssl_prefer_server_ciphers = on
ssl_ca_file = 'root.crt' # per pg doc, 18.9.3: To require the client to supply a trusted certificate
ssl_crl_file = ''
pg_hba.conf (in C:\Program Files\PostgreSQL\12\data, my understanding is its effect is on client such as web API or any DB consumers, not DB server) pg_hba.conf (在 C:\Program Files\PostgreSQL\12\data 中,我的理解是它的影响是在客户端,如 web API 或任何 DB 消费者)
...
hostssl all all 127.0.0.1/32 cert clientcert=1
...
pSQL shows it's communicating over SSL: pSQL 显示它正在通过 SSL 进行通信:
But a simple node project can connect without SSL :但是一个简单的节点项目可以在没有 SSL的情况下连接:
require('dotenv').config({ path: './environment/PostgreSql.env'});
const pgp = require('pg-promise')();
const db = pgp(
{
user: process.env.PGuser,
host: process.env.PGhost,
database: process.env.PGdatabase,
password: process.env.PGpassword,
port: process.env.PGport,
ssl: false // optional, but true gets code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'
}
);
var sql = 'select * from current.testssl()';
db.any(sql)
.then
(
good =>
{
console.log(good); // ssl false gets data
},
bad =>
{
console.log(bad);
/* ssl true gets
at TLSWrap.callbackTrampoline (internal/async_hooks.js:130:17)
{
code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
stack: 'Error: unable to verify the first certificate…ckTrampoline (internal/async_hooks.js:130:17)',
message: 'unable to verify the first certificate'
}
*/
}
);
Add the following line at the beginning of your pg_hba.conf
:在pg_hba.conf
的开头添加以下行:
hostnossl all all 0.0.0.0/0 reject
That will reject all connection attempts that use an unencrypted TCP connection.这将拒绝所有使用未加密 TCP 连接的连接尝试。
See the documentation for details.有关详细信息,请参阅 文档。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.