Thread: [Pypgsql-users] ssl connection support

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

whats kind of support for ssl connections does pypgsql have?

On Fri, Nov 19, 2004 at 06:54:15PM +1000, Timothy Smith wrote:
> whats kind of support for ssl connections does pypgsql have?

None so far, but it would be easy to add the additional parameters to
the connect() function in pyPgSQL/PgSQL.py.

-- Gerhard

Gerhard Haering <gh...@gh...> writes:

> On Fri, Nov 19, 2004 at 06:54:15PM +1000, Timothy Smith wrote:
>> whats kind of support for ssl connections does pypgsql have?
>
> None so far, but it would be easy to add the additional parameters to
> the connect() function in pyPgSQL/PgSQL.py.

None?  It seems to work here...  If I connect with pyPgSQL to a remote
database that only accepts SSL connections it accepts my connection.  If
I use psql without SSL, it doesn't connect at all, so I assumed it used
some library from the client side of PostgreSQL.  Am I wrong?

-- 
Godoy.     <go...@ie...>

Jorge Godoy wrote:
> Gerhard Haering <gh...@gh...> writes:
> 
> 
>>On Fri, Nov 19, 2004 at 06:54:15PM +1000, Timothy Smith wrote:
>>
>>>whats kind of support for ssl connections does pypgsql have?
>>
>>None so far, but it would be easy to add the additional parameters to
>>the connect() function in pyPgSQL/PgSQL.py.
> 
> None?  It seems to work here...  If I connect with pyPgSQL to a remote
> database that only accepts SSL connections it accepts my connection.  If
> I use psql without SSL, it doesn't connect at all, so I assumed it used
> some library from the client side of PostgreSQL.  Am I wrong?

Well, SSL support in pyPgSQL is just as good as the client library it's 
linked against.

It's just that pyPgSQL's connect() function doesn't have any way to pass 
information about SSL to the server. Like, if you require SSL, prefer 
SSL etc.

That's important if the server supports both SSL and non-SSL and you 
want to make sure which method is used.

-- Gerhard

Gerhard H=E4ring <gh...@gh...> writes:

> Well, SSL support in pyPgSQL is just as good as the client library it's=20
> linked against.

I see.  It is fine for me :-)

> It's just that pyPgSQL's connect() function doesn't have any way to pass=
=20
> information about SSL to the server. Like, if you require SSL, prefer=20
> SSL etc.

Yep.  I was looking for that but when I didn't find it I tried
connecting and everything just worked.

> That's important if the server supports both SSL and non-SSL and you=20
> want to make sure which method is used.

I wonder if there's too much overhead to justify using a non-SSL
connection when there's SSL available...  Isn't the order configurable
somewhere for the library used?  Here mine tries SSL first and then it
tries connecting without SSL...=20

--=20
Godoy.     <go...@ie...>

Jorge Godoy wrote:

>Timothy Smith <ti...@op...> writes:
>
>  
>
>>nah's it ok man i got it working, i was just having a blonde day that day.
>>the reason i asked about the ssl was i read on postgres's website that 
>>in order for ssl to work the client need the libaries as well. on your 
>>server you only allow hostssl and it works for you? have you done 
>>tcpdump to see if it is encrypted?
>>    
>>
>
>The server only allows SSL connections.  I tried non-SSL connections and
>they were refused (with pqsl, I can't specify how to connect with
>pypgsql).  I haven't done any check on the Windows machine, but I've
>seen that the traffic was encrypted from a linux box.
>
>  
>
by golly you are RIGHT

SSL connection (cipher: DHE-RSA-AES256-SHA, bits: 256)

when connecting by pgsql. and when doing a tcpdump -w /test i get random 
noise

my only connections allowed is hostssl

Jorge Godoy wrote:

>Timothy Smith <ti...@op...> writes:
>
>  
>
>>nah's it ok man i got it working, i was just having a blonde day that day.
>>the reason i asked about the ssl was i read on postgres's website that 
>>in order for ssl to work the client need the libaries as well. on your 
>>server you only allow hostssl and it works for you? have you done 
>>tcpdump to see if it is encrypted?
>>    
>>
>
>The server only allows SSL connections.  I tried non-SSL connections and
>they were refused (with pqsl, I can't specify how to connect with
>pypgsql).  I haven't done any check on the Windows machine, but I've
>seen that the traffic was encrypted from a linux box.
>
>  
>
hmm it doesn't work under windows.
any ideas? i have openssl installed. and it still doesn't work.
thats the error i get, so obviously under windows it's not turning it on.
works perfectly under frebsd 4.10, i'm using pypgsql 2.4 on both
no pg_hba.conf entry for host "192.168.1.1", user "timothy", database
"PubWare", SSL off

just an update, my windows python does include support for ssl. i have 
the _ssl.pyd file in dlls...

Timothy Smith wrote:
> hmm it doesn't work under windows. [...]

The pyPgSQL Windows binaries are statically linked against a version of 
the PostgreSQL client libraries that are *not* SSL-enabled.

I'll see if I can produce updated Windows binaries soon.

-- Gerhard

On Sun, Nov 28, 2004 at 02:57:25PM +0100, Gerhard H=E4ring wrote:
> Timothy Smith wrote:
> >hmm it doesn't work under windows. [...]
>=20
> The pyPgSQL Windows binaries are statically linked against a version of=
=20
> the PostgreSQL client libraries that are *not* SSL-enabled.
>=20
> I'll see if I can produce updated Windows binaries soon.

http://ghaering.de:9080/pypgsql/

pyPgSQL win32 binaries for win32. For Python 2.3 and Python 2.4.

This time, *dynamically* linked against PostgreSQL 8, beta 5.

I used the PostgreSQL libraries from PgAdmin 3.

So, I can guarantee it works with the libpq.dll from PgAdmin 3
somewhere in the search path. Tested it against my SSL-enabled
PostgreSQL 7.3.x and it works fine.

Still won't work against PostgreSQL 8 betas, because I built it
against the latest pyPgSQL release, which (and CVS still too, I
suppose) has this silly version string parsing problem.

Also unfortunately, the Python 2.4 binaries are of no great use,
because there are no readily available mxExtensions for Python 2.4.

HTH,

-- Gerhard

Timothy Smith <ti...@op...> writes:

> just an update, my windows python does include support for ssl. i have 
> the _ssl.pyd file in dlls...

There should be support for SSL at the PostgreSQL client library that
comes with pypgsql...  

-- 
Godoy.     <go...@ie...>

Jorge Godoy wrote:

>Timothy Smith <ti...@op...> writes:
>
>  
>
>>nah's it ok man i got it working, i was just having a blonde day that day.
>>the reason i asked about the ssl was i read on postgres's website that 
>>in order for ssl to work the client need the libaries as well. on your 
>>server you only allow hostssl and it works for you? have you done 
>>tcpdump to see if it is encrypted?
>>    
>>
>
>The server only allows SSL connections.  I tried non-SSL connections and
>they were refused (with pqsl, I can't specify how to connect with
>pypgsql).  I haven't done any check on the Windows machine, but I've
>seen that the traffic was encrypted from a linux box.
>
>  
>
hmm it doesn't work under windows.
any ideas? i have openssl installed. and it still doesn't work.
thats the error i get, so obviously under windows it's not turning it on.
works perfectly under frebsd 4.10, i'm using pypgsql 2.4 on both
no pg_hba.conf entry for host "192.168.1.1", user "timothy", database
"PubWare", SSL off

Thread: [Pypgsql-users] ssl connection support

pypgsql-users