Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
Greenplum
Gpdb
提交
98dba620
G
Gpdb
项目概览
Greenplum
/
Gpdb
通知
7
Star
1
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
Gpdb
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
98dba620
编写于
10月 20, 2000
作者:
T
Thomas G. Lockhart
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Fix ids and xrefs to avoid duplicates.
Remove copy/paste redundant extra section with slight merge of content.
上级
577fd41c
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
8 addition
and
62 deletion
+8
-62
doc/src/sgml/runtime.sgml
doc/src/sgml/runtime.sgml
+8
-62
未找到文件。
doc/src/sgml/runtime.sgml
浏览文件 @
98dba620
<!--
$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.
29 2000/10/19 04:53:41 tgl
Exp $
$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.
30 2000/10/20 14:00:49 thomas
Exp $
-->
<Chapter Id="runtime">
...
...
@@ -1014,7 +1014,7 @@ env PGOPTIONS='--geqo=off' psql
<listitem>
<para>
Enables <acronym>SSL</> connections. Please read
<xref linkend="ssl"> before using this. The default
<xref linkend="ssl
-tcp
"> before using this. The default
is off.
</para>
</listitem>
...
...
@@ -1637,7 +1637,7 @@ set semsys:seminfo_semmsl=32
</para>
</sect1>
<sect1 id="ssl">
<sect1 id="ssl
-tcp
">
<title>Secure TCP/IP Connections with SSL</title>
<para>
...
...
@@ -1654,7 +1654,8 @@ set semsys:seminfo_semmsl=32
can be started with the argument <option>-l</> (ell) to enable
SSL connections. When starting in SSL mode, the postmaster will look
for the files <filename>server.key</> and <filename>server.crt</> in
the data directory. These files should contain the server private key
the data directory (pointed to by <envar>PGDATA</envar>).
These files should contain the server private key
and certificate respectively. These files must be set up correctly
before an SSL-enabled server can start. If the private key is protected
with a passphrase, the postmaster will prompt for the passphrase and will
...
...
@@ -1664,7 +1665,8 @@ set semsys:seminfo_semmsl=32
<para>
The postmaster will listen for both standard and SSL connections
on the same TCP/IP port, and will negotiate with any connecting
client wether to use SSL or not. See <xref linkend="client-authentication">
client whether or not to use SSL.
See <xref linkend="client-authentication">
about how to force on the server side the use of SSL for certain
connections.
</para>
...
...
@@ -1695,63 +1697,7 @@ openssl x509 -inform PEM -outform PEM -in newreq.pem -out newkey_no_passphrase.p
</para>
</sect1>
<sect1 id="ssl">
<title>Secure TCP/IP Connection with SSL</title>
<para>
PostgreSQL has native support for connections over SSL to encrypt
client/server communications for increased security. This requires
<productname>OpenSSL</productname> to be installed on both client
and server systems and support enabled at compile-time using
the configure script.
</para>
<para>
With SSL support compiled in, the Postgres backend can be
started with argument -l to enable SSL connections.
When starting in SSL mode, the postmaster will look for the
files <filename>server.key</filename> and
<filename>server.cert</filename> in the <envar>PGDATA</envar>
directory. These files should contain the server private key and
certificate respectively. If the private key is protected with a
passphrase, the postmaster will prompt for the passphrase and not
start until it has been provided.
</para>
<para>
The postmaster will listen for both standard and SSL connections
on the same TCP/IP port, and will negotiate with any connecting
client wether to use SSL or not. Use the <filename>pg_hba.conf</filename>
file to optionally require SSL in order to accept a connection.
</para>
<para>
For details on how to create your server private key and certificate,
refer to the OpenSSL documentation. A simple self-signed certificate
can be used to get started testing, but a certificate signed by a CA
(either one of the global CAs or a local one) should be used in
production so the client can verify the servers identity. To create
a quick self-signed certificate, use the <filename>CA.pl</filename>
script included in OpenSSL:
<programlisting>
CA.pl -newcert
</programlisting>
Fill out the information the script asks for. Make sure to enter
the local hostname as Common Name. The script will generate a key
which is passphrase protected. To remove the passphrase (required
if you want automatic startup of the postmaster), run the command
<programlisting>
openssl x509 -inform PEM -outform PEM -in newreq.pem -out newkey_no_passphrase.pem
</programlisting>
Enter the old passphrase to unlock the existing key. Copy the file
<filename>newreq.pem</filename> to <filename>PGDATA/server.cert</filename>
and <filename>newkey_no_passphrase.pem</filename> to
<filename>PGDATA/server.key</filename>. Remove the PRIVATE KEY part
from the <filename>server.cert</filename> using any text editor.
</para>
</sect1>
<sect1 id="ssh">
<sect1 id="ssh-tunnels">
<title>Secure TCP/IP Connections with SSH tunnels</title>
<note>
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录