fruworg.github.io/postgres-ldaps.md at db1d3b935b4fe9acdfc0d41e0552b4707cfdfe83

fruworg/fruworg.github.io

mirror of https://github.com/fruworg/fruworg.github.io.git synced 2024-11-16 17:37:17 +03:00

root 9c4706e826 Committer: fruworg <im@fruw.org>

On branch main
Your branch is up to date with 'origin/main'.

Changes to be committed:
	new file:   .gitmodules
	new file:   archetypes/default.md
	new file:   config.toml
	new file:   content/posts/ald-pro.md
	new file:   content/posts/astra-fly.md
	new file:   content/posts/astra-freeipa.md
	new file:   content/posts/bareos-install.md
	new file:   content/posts/cifs-automount.md
	new file:   content/posts/create-user-keytab.md
	new file:   content/posts/create-user-keytab.md.save
	new file:   content/posts/dhcp-resolv.md
	new file:   content/posts/github-ssh-auth.md
	new file:   content/posts/ip-command.md
	new file:   content/posts/linux-krb5.md
	new file:   content/posts/linux-network.md
	new file:   content/posts/linux-nfs.md.save
	new file:   content/posts/linux-packages-rebuild.md
	new file:   content/posts/lvm-base-commands.md
	new file:   content/posts/pfx-to-pem.md
	new file:   content/posts/pg-probackup-setup.md.save
	new file:   content/posts/pg-probackup-setup.md.save.1
	new file:   content/posts/postgres-drop-db.md
	new file:   content/posts/postgres-krb5.md
	new file:   content/posts/postgres-ldaps.md
	new file:   content/posts/postgres-pro-astra-se.md
	new file:   content/posts/postgres-replication.md
	new file:   content/posts/postgres-simple-backup.md
	new file:   content/posts/postgres-tls.md
	new file:   content/posts/reverse-shell-nc.md
	new file:   content/posts/run-nologin.md
	new file:   content/posts/security-solutions.md
	new file:   content/posts/selfsigned-to-trusted.md
	new file:   content/posts/ssh-2fa-totp.md
	new file:   content/posts/ssh-auth-by-key.md
	new file:   content/posts/ssh-fail2ban.md
	new file:   content/posts/vmware-clipboard.md
	new file:   content/posts/vmware-restart-date.md
	new file:   content/posts/windows-disable-shutdown.md
	new file:   static/0x952C15AB751A65F6
	new file:   static/favicon.ico
	new file:   static/fruworg.png
	new file:   themes/archie

 Changes not staged for commit:
	modified:   themes/archie (modified content)

2023-07-26 20:55:24 +05:00

1.4 KiB

Raw Blame History

title

description

date

Выпуск сертфиката

AD необходимо дать роль CA и выпустить сертификат. Подробнее: https://youtu.be/xC3ujXGkh_c?t=160

Перенос сертификата

Необходимо перенести выпущенный конечный сертификат на сервер СУБД и перекодировать следующей командой:

openssl x509 -inform der -in <ad>.cer -out <ad>.pem

Установка пакета ldap-utils

apt install ldap-utils -y

Правка ldap конфига

TLS_CACERT	/etc/ldap/<ad>.pem
BASE		dc=<domain>,dc=<local>
URI 		ldaps://<dc>.<domain>.<local>:636

# /etc/ldap/ldap.conf

Проверка ldap

ldapsearch -x -b "dc=<domain>,dc=<local>" \
	-H ldaps://<dc>.<domain>.<local>:636 -W -D <domain-user>

Правка pg_hba.conf

host	<database>	<user>	<ip>/<mask>	ldap	ldapserver=<dc>.<domain>.<local>	ldapprefix="cn="	ldapsuffix=",cn=users,dc=<domain>,dc=<local>"

# /var/lib/pgpro/std-14/data/pg_hba.conf

Создание пользователя в Postgres

psql -c "CREATE USER <domain-user>;"

Перезапуск Postgres Pro

systemctl restart postgres*

1.4 KiB Raw Blame History