mirror of
https://github.com/fruworg/fruworg.github.io.git
synced 2024-11-16 17:37:17 +03:00
9c4706e826
On branch main Your branch is up to date with 'origin/main'. Changes to be committed: new file: .gitmodules new file: archetypes/default.md new file: config.toml new file: content/posts/ald-pro.md new file: content/posts/astra-fly.md new file: content/posts/astra-freeipa.md new file: content/posts/bareos-install.md new file: content/posts/cifs-automount.md new file: content/posts/create-user-keytab.md new file: content/posts/create-user-keytab.md.save new file: content/posts/dhcp-resolv.md new file: content/posts/github-ssh-auth.md new file: content/posts/ip-command.md new file: content/posts/linux-krb5.md new file: content/posts/linux-network.md new file: content/posts/linux-nfs.md.save new file: content/posts/linux-packages-rebuild.md new file: content/posts/lvm-base-commands.md new file: content/posts/pfx-to-pem.md new file: content/posts/pg-probackup-setup.md.save new file: content/posts/pg-probackup-setup.md.save.1 new file: content/posts/postgres-drop-db.md new file: content/posts/postgres-krb5.md new file: content/posts/postgres-ldaps.md new file: content/posts/postgres-pro-astra-se.md new file: content/posts/postgres-replication.md new file: content/posts/postgres-simple-backup.md new file: content/posts/postgres-tls.md new file: content/posts/reverse-shell-nc.md new file: content/posts/run-nologin.md new file: content/posts/security-solutions.md new file: content/posts/selfsigned-to-trusted.md new file: content/posts/ssh-2fa-totp.md new file: content/posts/ssh-auth-by-key.md new file: content/posts/ssh-fail2ban.md new file: content/posts/vmware-clipboard.md new file: content/posts/vmware-restart-date.md new file: content/posts/windows-disable-shutdown.md new file: static/0x952C15AB751A65F6 new file: static/favicon.ico new file: static/fruworg.png new file: themes/archie Changes not staged for commit: modified: themes/archie (modified content)
54 lines
1.4 KiB
Markdown
54 lines
1.4 KiB
Markdown
---
|
|
title: ldaps аутентификация в Postgres Pro
|
|
description: ad+ldaps+postgres
|
|
date: 2023-06-01T20:40:00+05:00
|
|
tags: [linux, postgres, ad, ldap, tls, windows]
|
|
---
|
|
## Выпуск сертфиката
|
|
AD необходимо дать роль CA и выпустить сертификат. Подробнее: https://youtu.be/xC3ujXGkh_c?t=160
|
|
|
|
## Перенос сертификата
|
|
Необходимо перенести выпущенный конечный сертификат на сервер СУБД и перекодировать следующей командой:
|
|
|
|
```shell
|
|
openssl x509 -inform der -in <ad>.cer -out <ad>.pem
|
|
```
|
|
|
|
## Установка пакета ldap-utils
|
|
```shell
|
|
apt install ldap-utils -y
|
|
```
|
|
|
|
## Правка ldap конфига
|
|
```shell
|
|
TLS_CACERT /etc/ldap/<ad>.pem
|
|
BASE dc=<domain>,dc=<local>
|
|
URI ldaps://<dc>.<domain>.<local>:636
|
|
|
|
# /etc/ldap/ldap.conf
|
|
```
|
|
|
|
## Проверка ldap
|
|
```shell
|
|
ldapsearch -x -b "dc=<domain>,dc=<local>" \
|
|
-H ldaps://<dc>.<domain>.<local>:636 -W -D <domain-user>
|
|
```
|
|
|
|
## Правка pg_hba.conf
|
|
```shell
|
|
host <database> <user> <ip>/<mask> ldap ldapserver=<dc>.<domain>.<local> ldapprefix="cn=" ldapsuffix=",cn=users,dc=<domain>,dc=<local>"
|
|
|
|
# /var/lib/pgpro/std-14/data/pg_hba.conf
|
|
```
|
|
|
|
## Создание пользователя в Postgres
|
|
```shell
|
|
psql -c "CREATE USER <domain-user>;"
|
|
```
|
|
|
|
## Перезапуск Postgres Pro
|
|
```shell
|
|
systemctl restart postgres*
|
|
```
|
|
|