From c7b08050d9a2b68b27045b36ff4c9a3db85a55e4 Mon Sep 17 00:00:00 2001 From: Bruce Momjian Date: Fri, 16 Feb 2007 02:59:41 +0000 Subject: SSL improvements: o read global SSL configuration file o add GUC "ssl_ciphers" to control allowed ciphers o add libpq environment variable PGSSLKEY to control SSL hardware keys Victor B. Wagner --- doc/src/sgml/config.sgml | 16 +++++++++++++++- doc/src/sgml/libpq.sgml | 43 ++++++++++++++++++++++++++++++++++++++++--- doc/src/sgml/runtime.sgml | 25 ++++++++++++++++++++++--- 3 files changed, 77 insertions(+), 7 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index e5c73b4e361..aa5c15f1a01 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1,4 +1,4 @@ - + Server Configuration @@ -569,6 +569,20 @@ SET ENABLE_SEQSCAN TO OFF; + + ssl_ciphers> (string) + + ssl_ciphers configuration parameter + + + + Specifies a list of SSL ciphers which can be used to + establish secure connections. See the openssl + manual page for a list of supported ciphers. + + + + password_encryption (boolean) diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 4c017334e1d..dd8ab08fe2b 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -1,4 +1,4 @@ - + <application>libpq</application> - C Library @@ -4174,6 +4174,18 @@ setting, and is only available if + +PGSSLKEY + +PGSSLKEY +specifies the hardware token which stores the secret key for the client +certificate, instead of a file. The value of this variable should consist +of a colon-separated engine name (engines are OpenSSL +loadable modules) and an engine-specific key identifier. + + + + PGKRBSRVNAME @@ -4438,19 +4450,44 @@ ldap://ldap.mycompany.com/dc=mycompany,dc=com?uniqueMember?one?(cn=mydatabase) for increased security. See for details about the server-side SSL functionality. - + + libpq reads the system-wide + OpenSSL configuration file. By default, this + file is named openssl.cnf and is located in the + directory reported by openssl: + + openssl version -d + + The default can be overriden by setting environment variable + OPENSSL_CONF to the name of the desired configuration + file. + If the server demands a client certificate, libpq will send the certificate stored in file ~/.postgresql/postgresql.crt within the user's home directory. A matching private key file ~/.postgresql/postgresql.key - must also be present, and must not be world-readable. + must also be present, and must not be world-readable, unless the secret + key is stored in a hardware token, as specified by + PGSSLKEY. (On Microsoft Windows these files are named %APPDATA%\postgresql\postgresql.crt and %APPDATA%\postgresql\postgresql.key.) + + If the environment variable PGSSLKEY is set, its value + should consist of a colon-separated engine name and key identifier. In + this case, libpq will load the specified + engine, i.e. the OpenSSL module which supports special + hardware and reference the key with the specified identifier. + Identifiers are engine-specific. Typically, cryptography hardware tokens + do not reveal secret keys to the application. Instead, applications + delegate all cryptography operations which require the secret key to + the hardware token. + + If the file ~/.postgresql/root.crt is present in the user's home directory, diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml index 4baec332766..7bed97a86f3 100644 --- a/doc/src/sgml/runtime.sgml +++ b/doc/src/sgml/runtime.sgml @@ -1,4 +1,4 @@ - + Operating System Environment @@ -1515,6 +1515,25 @@ $ kill -INT `head -1 /usr/local/pgsql/data/postmaster.pid`SSL for some or all connections. + + OpenSSL supports a wide range of ciphers + and authentication algorithms, whose strength varies significantly. + You can restrict the list of ciphers which can be used to connect to + your server using the parameter. + + + + PostgreSQL reads a system-wide + OpenSSL configuration file. By default this + file is named openssl.cnf and is located in the + directory reported by openssl: + + openssl version -d + + This default can be overriden by setting environment variable + OPENSSL_CONF to the name of desired configuration file. + + For details on how to create your server private key and certificate, refer to the OpenSSL documentation. A @@ -1528,8 +1547,8 @@ $ kill -INT `head -1 /usr/local/pgsql/data/postmaster.pid` openssl req -new -text -out server.req - Fill out the information that openssl asks for. Make sure - that you enter the local host name as Common Name; the challenge + Fill out the information that openssl asks for. Make sure + you enter the local host name as Common Name; the challenge password can be left blank. The program will generate a key that is passphrase protected; it will not accept a passphrase that is less than four characters long. To remove the passphrase (as you must if -- cgit v1.2.3