Can't turn on SSL for PGSQL from config during setup #557

rnalrd · 2024-05-02T12:49:54Z

Trying to use SSL when connecting to PGSQL. Using command line option -database-ssl-mode=require works no problem, but using config option sslmode="require" it doesn't.

~ # cat /etc/homer/webapp_config.json | jq '.database_data, .database_config'
{
  "LocalNode": {
    "help": "Settings for PGSQL Database (data)",
    "node": "LocalNode",
    "user": "homer_user",
    "pass": "password",
    "name": "homer_data",
    "keepalive": true,
    "host": "homer-db",
    "sslmode": "require"
  }
}
{
  "help": "Settings for PGSQL Database (settings)",
  "node": "LocalConfig",
  "user": "homer_user",
  "pass": "passwod",
  "name": "homer_config",
  "keepalive": true,
  "host": "homer-db",
  "sslmode": "require"
}
~ # homer-app -create-homer-user -database-root-user=$dbuser -database-host=$dbhost -database-root-password=$dbpass -webapp-config-path=/etc/homer
 
CONNECT to DB ROOT STRING: [host=homer-db user=postgres dbname=postgres sslmode=disable port=5432 password=lesson_learned]
 
panic: pq: no pg_hba.conf entry for host "bad:beef:caffe:1016::169", user "postgres", database "postgres", no encryption

goroutine 1 [running]:
main.checkAdminFlags()
	/app/main.go:1840 +0xfe5
main.main()
	/app/main.go:225 +0xaf

~ #### turning on SSL via CLI option works
~ # homer-app -create-homer-user -database-root-user=$dbuser -database-host=$dbhost -database-root-password=$dbpass -webapp-config-path=/etc/homer  -database-ssl-mode=require
 
CONNECT to DB ROOT STRING: [host=homer-db user=postgres dbname=postgres sslmode=require port=5432 password=lesson_learned]
 
 
HOMER - creating user [user=homer_user password=homer_password] 

(/app/migration/migration.go:62) 
[2024-05-02 12:44:13]  [60.70ms]  CREATE USER "homer_user" WITH PASSWORD 'homer_password'  
[0 rows affected or returned ] 
 
DONE 
 
HOMER - show users 
	Role name	|	Attributes
------------------------------------------------
	homer_user	|		
	postgres	|	superuser, create database	
 
DONE 
~ # homer-app -version
VERSION: 1.4.59

The text was updated successfully, but these errors were encountered:

hamidrhashmi · 2024-05-03T10:00:14Z

Hi @rnalrd

Please try using usessl

{
  "LocalNode": {
    "help": "Settings for PGSQL Database (data)",
    "node": "LocalNode",
    "user": "homer_user",
    "pass": "password",
    "name": "homer_data",
    "keepalive": true,
    "host": "homer-db",
    "usessl": true
  }
}

check this.

rnalrd · 2024-05-03T10:49:19Z

Same problem with "usessl"

~ # cat /etc/homer/webapp_config.json | jq '.database_data, .database_config'
{
  "LocalNode": {
    "help": "Settings for PGSQL Database (data)",
    "node": "LocalNode",
    "user": "homer_user",
    "pass": "password",
    "name": "homer_data",
    "keepalive": true,
    "host": "homer-db",
    "usessl": true
  }
}
{
  "help": "Settings for PGSQL Database (settings)",
  "node": "LocalConfig",
  "user": "homer_user",
  "pass": "password",
  "name": "homer_config",
  "keepalive": true,
  "host": "homer-db",
  "usessl": true
}
~ # homer-app -create-homer-user -database-root-user=$dbuser -database-host=$dbhost -database-root-password=$dbpass -webapp-config-path=/etc/homer
 
CONNECT to DB ROOT STRING: [host=homer-db user=postgres dbname=postgres sslmode=disable port=5432 password=password]
 
panic: pq: no pg_hba.conf entry for host "bad:beef:cafe:1016::169", user "postgres", database "postgres", no encryption

goroutine 1 [running]:
main.checkAdminFlags()
	/app/main.go:1840 +0xfe5
main.main()
	/app/main.go:225 +0xaf

hamidrhashmi · 2024-05-06T10:00:27Z

I have tested with version 1.4.59 and with param "usessl=true" it prints log line

{"level":"info","msg":"Connecting to [127.0.0.1, homer_user, homer_data, LocalNode, 0, ssl: require]\n","time":"2024-05-06T04:37:10-05:00"}

while with "usessl=false" it prints

{"level":"info","msg":"Connecting to [127.0.0.1, homer_user, homer_data, LocalNode, 0, ssl: disable]\n","time":"2024-05-06T04:35:33-05:00"}

and it is working in both scenarios. try enabling debug log in webapp config and share homer-app logs.

rnalrd · 2024-05-08T06:39:49Z

homer:~# cat /etc/homer/webapp_config.json | jq '.database_data, .database_config, .system_settings'
{
  "LocalNode": {
    "help": "Settings for PGSQL Database (data)",
    "node": "LocalNode",
    "user": "homer_user",
    "pass": "password",
    "name": "homer_data",
    "keepalive": true,
    "host": "homer-db",
    "usessl": true
  }
}
{
  "help": "Settings for PGSQL Database (settings)",
  "node": "LocalConfig",
  "user": "homer_user",
  "pass": "password",
  "name": "homer_config",
  "keepalive": true,
  "host": "homer-db",
  "usessl": true
}
{
  "help": "Settings for HOMER logs",
  "logpath": "/var/log/homer",
  "logname": "homer-app.log",
  "_loglevels": "can be: fatal, error, warn, info, debug, trace",
  "loglevel": "debug",
  "logstdout": true
}
homer:~# homer-app -create-homer-user -database-root-user=$dbuser -database-host=$dbhost -database-root-password=$dbpass -webapp-config-path=/etc/homer
{"level":"info","msg":"init logging system","time":"2024-05-08T06:35:22Z"}
 
CONNECT to DB ROOT STRING: [host=homer-db user=postgres dbname=postgres sslmode=disable port=5432 password=password]
 
{"level":"error","msg":"pq: no pg_hba.conf entry for host \"dead:beef::1016::169\", user \"postgres\", database \"postgres\", no encryption","time":"2024-05-08T06:35:22Z"}
{"level":"error","msg":"Couldn't establish connection. Please be sure you can have correct passwordpq: no pg_hba.conf entry for host \"dead:beef::1016::169\", user \"postgres\", database \"postgres\", no encryption","time":"2024-05-08T06:35:22Z"}
{"level":"error","msg":"Try run: sudo -u postgres psql -c \"ALTER USER postgres PASSWORD 'postgres';\"","time":"2024-05-08T06:35:22Z"}
panic: pq: no pg_hba.conf entry for host "dead:beef::1016::169", user "postgres", database "postgres", no encryption

goroutine 1 [running]:
main.checkAdminFlags()
	/app/main.go:1840 +0xfe5
main.main()
	/app/main.go:225 +0xaf

Adding -database-ssl-mode=require everything works as it should:

homer:~# homer-app -create-homer-user -database-root-user=$dbuser -database-host=$dbhost -database-root-password=$dbpass -database-ssl-mode=require -webapp-config-path=/etc/homer
{"level":"info","msg":"init logging system","time":"2024-05-08T06:36:04Z"}
 
CONNECT to DB ROOT STRING: [host=homer-db user=postgres dbname=postgres sslmode=require port=5432 password=password]
 
{"level":"debug","msg":"----------------------------------- ","time":"2024-05-08T06:36:04Z"}
{"level":"debug","msg":"*** Database Data Root Session created *** ","time":"2024-05-08T06:36:04Z"}
{"level":"debug","msg":"----------------------------------- ","time":"2024-05-08T06:36:04Z"}
 
HOMER - creating user [user=homer_user password=homer_password] 

(/app/migration/migration.go:62) 
[2024-05-08 06:36:04]  pq: role "homer_user" already exists 

(/app/migration/migration.go:62) 
[2024-05-08 06:36:04]  [0.72ms]  CREATE USER "homer_user" WITH PASSWORD 'homer_password'  
[0 rows affected or returned ] 
 
DONE 
 
HOMER - show users 
	Role name	|	Attributes
------------------------------------------------
	health_check	|		
	homer_user	|		
	postgres	|	superuser, create database	
	replication	|		
	sr_check_user	|		
 
DONE

hamidrhashmi · 2024-05-08T07:07:00Z

I followed this blog to configure SSL on Postgres. May you have to follow Step 6 to resolve no pg_hba.conf entry for host.

rnalrd · 2024-05-08T11:19:51Z

my pg_hba.conf does not allow non-SSL connections, that is why there's the error with "no encryption":

{"level":"error","msg":"pq: no pg_hba.conf entry for host \"dead:beef::1016::169\", user \"postgres\", database \"postgres\", no encryption","time":"2024-05-08T06:35:22Z"}
{"level":"error","msg":"Couldn't establish connection. Please be sure you can have correct passwordpq: no pg_hba.conf entry for host \"dead:beef::1016::169\", user \"postgres\", database \"postgres\", no encryption","time":"2024-05-08T06:35:22Z"}

When I add the CLI option -database-ssl-mode=require the connection is accepted. The problem is that "usessl: true" in config does not do its job, I need to specify via CLI that I want an SSL connection.

adubovikov · 2024-06-19T08:04:41Z

we can add the custom fields

adubovikov · 2024-06-19T08:12:04Z

9e5c7b8

please test it, you can specify any params inside

adubovikov · 2024-09-03T08:06:38Z

closed as resolved

github-actions bot added the stargazed label May 2, 2024

adubovikov closed this as completed Sep 3, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Can't turn on SSL for PGSQL from config during setup #557

Can't turn on SSL for PGSQL from config during setup #557

rnalrd commented May 2, 2024

hamidrhashmi commented May 3, 2024

rnalrd commented May 3, 2024 •

edited

Loading

hamidrhashmi commented May 6, 2024

rnalrd commented May 8, 2024

hamidrhashmi commented May 8, 2024

rnalrd commented May 8, 2024

adubovikov commented Jun 19, 2024

adubovikov commented Jun 19, 2024

adubovikov commented Sep 3, 2024

Can't turn on SSL for PGSQL from config during setup #557

Can't turn on SSL for PGSQL from config during setup #557

Comments

rnalrd commented May 2, 2024

hamidrhashmi commented May 3, 2024

rnalrd commented May 3, 2024 • edited Loading

hamidrhashmi commented May 6, 2024

rnalrd commented May 8, 2024

hamidrhashmi commented May 8, 2024

rnalrd commented May 8, 2024

adubovikov commented Jun 19, 2024

adubovikov commented Jun 19, 2024

adubovikov commented Sep 3, 2024

rnalrd commented May 3, 2024 •

edited

Loading