Problem - Kevin Tafuro

In a default configuration, PostgreSQLdoes not require clients to connect to the
server with SSL; the use of SSL is strictly a client option. However, clients can be
required to use SSL using the hostssl record format in the pg_hba.conf file.
The PostgreSQLC API function PQconnectdb( ) requires that a conninfo object be
filled in and passed to it to establish a connection to the server. One of the fields in
the conninfo structure is an integer field called requiressl, which allows the client to
decide whether SSLshould or should not be required for the connection. If this field
is set to 1, the connection will fail if the server does not support SSL; otherwise, the
use of SSLwill be negotiated as part of the connection handshake. In the latter case,
SSLwill only be used if a hostssl record exists in pg_hba.conf requiring the use of
SSL by clients.
See Also
Recipe 9.5
9.11 Using a Virtual Private Network to Secure
Network Connections
Problem
Your program operates over a network and interacts with an existing network infrastructure
that provides no support for secure communications such as SSL. You’re
guaranteed that your program will be used only by a select group of people, and you
need to secure its network traffic against sniffing and hijacking.
Solution
For this type of problem, using an SSLtunnel such as Stunnel is sufficient, but the
certificate requirements and limited verification options provided by Stunnel may not
provide everything you need. In addition, some network protocols do not lend themselves
to SSLtunneling. (FTP is such a protocol because it may use random ports in
both directions.) An alternate solution is to use a virtual private network (VPN) for
the network services that your program needs.
Discussion
VPNs can be tricky to set up and get to work properly. There can be many interoperability
problems across platforms, but VPNs provide a clean solution insofar as
requiring fewer modifications to firewall rules (especially if there are many insecure
network services involved), less deployment of tunneling software, and less ongoing
490 | Chapter 9: Networking
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.