Áú»¢¶Ä²©

2 §¬§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú?§Ñ PostgreSQL §Ö§ß§Ü§â§Ú§á§è§Ú?§Ö

§±§â§Ö§Ô§Ý§Ö§Õ

§°§Ó§Ñ §ã§Ö§Ü§è§Ú?§Ñ §á§â§å§Ø§Ñ §ß§Ö§Ü§à§Ý§Ú§Ü§à §á§â§Ú§Þ§Ö§â§Ñ §Ü§à§ß§æ§Ú§Ô§å§â§Ñ§è§Ú?§Ö §ê§Ú§æ§â§à§Ó§Ñ?§Ñ §Ù§Ñ CentOS 8.2 §Ú PostgreSQL 13.

§£§Ö§Ù§Ñ §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §Ü§à§â§Ú§ã§ß§Ú§é§Ü§à§Ô §Ú§ß§ä§Ö§â§æ§Ö?§ã§Ñ §Ú PostgreSQL-§Ñ §ß§Ö §Þ§à§Ø§Ö §Ò§Ú§ä§Ú §ê§Ú§æ§â§à§Ó§Ñ§ß§Ñ (§á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú §å GUI §ã§å §à§ß§Ö§Þ§à§Ô§å?§Ö§ß§Ú), §Ñ§Ü§à §Ó§â§Ö§Õ§ß§à§ã§ä §á§à?§Ñ §¥§à§Þ§Ñ?§Ú§ß§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §á§à§é§Ú?§Ö §Ü§à§ã§à§Þ §è§â§ä§à§Þ §Ú§Ý§Ú ?§Ö §á§à?§Ö §á§â§Ñ§Ù§ß§à.

§±§â§Ö§Õ§å§ã§Ý§à§Ó§Ú

§ª§ß§ã§ä§Ñ§Ý§Ú§â§Ñ?§ä§Ö PostgreSQL §Ò§Ñ§Ù§å §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ü§à§â§Ú§ã§ä§Ö?§Ú .

PostgreSQL §ß§Ú?§Ö §Ü§à§ß§æ§Ú§Ô§å§â§Ú§ã§Ñ§ß §Ù§Ñ §á§â§Ú§ç§Ó§Ñ§ä§Ñ?§Ö TLS §Ü§à§ß§Ö§Ü§è§Ú?§Ñ §Ó§Ñ§ß §Ü§å§ä§Ú?§Ö. §±§â§Ñ§ä§Ú§ä§Ö §å§á§å§ä§ã§ä§Ó§Ñ §Ú§Ù PostgreSQL §Õ§à§Ü§å§Þ§Ö§ß§ä§Ñ§è§Ú?§Ö §Ù§Ñ §Ú §ä§Ñ§Ü§à?§Ö §Ù§Ñ §á§â§Ö§Ü§à ph_hba.conf.

§±§à§Õ§â§Ñ§Ù§å§Þ§Ö§Ó§Ñ§ß§à, PostgreSQL §ã§à§Ü§Ö§ä ?§Ö §Ó§Ö§Ù§Ñ§ß §Ù§Ñ §Ý§à§Ü§Ñ§Ý§ß§Ú §Õ§à§Þ§Ñ?§Ú§ß, §Ù§Ñ §Þ§â§Ö§Ø§ß§Ö §å§Õ§Ñ?§Ö§ß§Ö §Ó§Ö§Ù§Ö §Ü§Ñ§Ü§à §Ò§Ú §ã§Ö §à§Þ§à§Ô§å?§Ú§Ý§à §ã§Ý§å§ê§Ñ?§Ö §ß§Ñ §ã§ä§Ó§Ñ§â§ß§à? §Þ§â§Ö§Ø§Ú §Ú§ß§ä§Ö§â§æ§Ö?§ã.

PostgreSQL §á§à§Õ§Ö§ê§Ñ§Ó§Ñ?§Ñ §Ù§Ñ §ã§Ó§Ö §â§Ö§Ø§Ú§Þ§Ú §Þ§à§Ø§Ö §Ú§Ù§Ô§Ý§Ö§Õ§Ñ§ä§Ú §Ü§Ñ§à §à§Ó§à:

/var/lib/pgsql/13/data/postgresql.conf:

...
       ssl = on
       ssl_ca_file = 'root.crt'
       ssl_cert_file = 'server.crt'
       ssl_key_file = 'server.key'
       ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
       ssl_prefer_server_ciphers = on
       ssl_min_protocol_version = 'TLSv1.3'
       ...

§©§Ñ §Ü§à§ß§ä§â§à§Ý§å §á§â§Ú§ã§ä§å§á§Ñ §á§à§Õ§Ö§ã§Ú§ä§Ö /var/lib/pgsql/13/data/pg_hba.conf:

...
       ### require
       hostssl all all 0.0.0.0/0 md5
       
       ### verify CA
       hostssl all all 0.0.0.0/0 md5 clientcert=verify-ca
       
       ### verify full
       hostssl all all 0.0.0.0/0 md5 clientcert=verify-full
       ...

§º§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ§Þ§à §Ù§Ñ §ä§â§Ñ§ß§ã§á§à§â§ä

§¬§à§â§Ú§ã§ß§Ú§é§Ü§Ú §Ú§ß§ä§Ö§â§æ§Ö?§ã

§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ§Þ§à §Ù§Ñ §ä§â§Ñ§ß§ã§á§à§â§ä §Ù§Ñ §Ó§Ö§Ù§Ö §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §Ü§à§â§Ú§ã§ß§Ú§é§Ü§à§Ô §Ú§ß§ä§Ö§â§æ§Ö?§ã§Ñ §Ú §Ò§Ñ§Ù§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ:

  • §±§â§à§Ó§Ö§â§Ú§ä§Ö * §º§Ú§æ§â§à§Ó§Ñ?§Ö TLS §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ*
  • §°§ã§ä§Ñ§Ó§Ú§ä§Ö §±§â§à§Ó§Ö§â§Ú §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §ß§Ö§à§Ù§ß§Ñ§é§Ö§ß§Ú§Þ

§³§Ö§â§Ó§Ö§â

§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ§Þ§à §Ù§Ñ §ä§â§Ñ§ß§ã§á§à§â§ä §Ù§Ñ §Ó§Ö§Ù§Ö §Ú§Ù§Þ§Ö?§å §ã§Ö§â§Ó§Ö§â§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ, §Ü§à§ß§æ§Ú§Ô§å§â§Ú§ê§Ú§ä§Ö /etc/zabbix/zabbix_server.conf:

...
       DBHost=10.211.55.9
       DBName=zabbix
       DBUser=zbx_srv
       DBPassword=<strong_password>
       DBTLSConnect=required
       ...

§º§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§à§Þ §Ñ§å§ä§à§â§Ú§ä§Ö§ä§Ñ §Ù§Ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä

§¬§à§â§Ú§ã§ß§Ú§é§Ü§Ú §Ú§ß§ä§Ö§â§æ§Ö?§ã

§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§à§Þ §Ñ§å§ä§à§â§Ú§ä§Ö§ä§Ñ §Ù§Ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ö §Ù§Ñ §Ó§Ö§Ù§Ö §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §Ü§à§â§Ú§ã§ß§Ú§é§Ü§à§Ô §Ú§ß§ä§Ö§â§æ§Ö?§ã§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ:

  • §±§â§à§Ó§Ö§â§Ú§ä§Ö * TLS §ê§Ú§æ§â§à§Ó§Ñ?§Ö §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ* §Ú §£§Ö§â§Ú§æ§Ú§Ü§à§Ó§Ñ?§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ
  • §¯§Ñ§Ó§Ö§Õ§Ú§ä§Ö §á§å§ä§Ñ?§å §Õ§à TLS CA §Õ§Ñ§ä§à§ä§Ö§Ü§Ö §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ

§¡§Ý§ä§Ö§â§ß§Ñ§ä§Ú§Ó§ß§à, §à§Ó§à §ã§Ö §Þ§à§Ø§Ö §á§à§Õ§Ö§ã§Ú§ä§Ú §å /etc/zabbix/web/zabbix.conf.php:

...
       $DB['ENCRYPTION'] = true;
       $DB['KEY_FILE'] = '';
       $DB['CERT_FILE'] = '';
       $DB['CA_FILE'] = '/etc/ssl/pgsql/root.crt';
       $DB['VERIFY_HOST'] = false;
       $DB['CIPHER_LIST'] = '';
       ...

§³§Ö§â§Ó§Ö§â

§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§à§Þ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Ù§Ñ §Ó§Ö§Ù§Ö §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ, §Ü§à§ß§æ§Ú§Ô§å§â§Ú§ê§Ú§ä§Ö /etc/zabbix/zabbix_server.conf:

...
       DBHost=10.211.55.9
       DBName=zabbix
       DBUser=zbx_srv
       DBPassword=<strong_password>
       DBTLSConnect=verify_ca
       DBTLSCAFile=/etc/ssl/pgsql/root.crt
       ...

§º§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §á§à§ä§á§å§ß§à§Þ §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§à§Þ

§¬§à§â§Ú§ã§ß§Ú§é§Ü§Ú §Ú§ß§ä§Ö§â§æ§Ö?§ã

§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Þ §Ú §Ú§Õ§Ö§ß§ä§Ú§ä§Ö§ä§à§Þ §Õ§à§Þ§Ñ?§Ú§ß§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§Ñ §Ó§Ö§Ù§Ñ §Ú§Ù§Þ§Ö?§å Áú»¢¶Ä²© §Ü§à§â§Ú§ã§ß§Ú§é§Ü§à§Ô §Ú§ß§ä§Ö§â§æ§Ö?§ã§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ:

  • §±§â§à§Ó§Ö§â§Ú§ä§Ö §º§Ú§æ§â§à§Ó§Ñ?§Ö TLS §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ú §£§Ö§â§Ú§æ§Ú§Ü§å?§ä§Ö §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ
  • §¯§Ñ§Ó§Ö§Õ§Ú§ä§Ö §á§å§ä§Ñ?§å §Õ§à §¬?§å§é TLS §Õ§Ñ§ä§à§ä§Ö§Ü§Ö §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ
  • §¯§Ñ§Ó§Ö§Õ§Ú§ä§Ö §á§å§ä§Ñ?§å §Õ§à §¥§Ñ§ä§à§ä§Ö§Ü§Ö TLS CA §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ
  • §°§Õ§â§Ö§Õ§Ú§ä§Ö §á§å§ä§Ñ?§å §Õ§à §¥§Ñ§ä§à§ä§Ö§Ü§Ö TLS §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ
  • §±§â§à§Ó§Ö§â§Ú§ä§Ö §Ó§Ö§â§Ú§æ§Ú§Ü§Ñ§è§Ú?§å §Õ§à§Þ§Ñ?§Ú§ß§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ

§¡§Ý§ä§Ö§â§ß§Ñ§ä§Ú§Ó§ß§à, §à§Ó§à §ã§Ö §Þ§à§Ø§Ö §á§à§Õ§Ö§ã§Ú§ä§Ú §å /etc/zabbix/web/zabbix.conf.php:

$DB['ENCRYPTION'] = true;
       $DB['KEY_FILE'] = '';
       $DB['CERT_FILE'] = '';
       $DB['CA_FILE'] = '/etc/ssl/pgsql/root.crt';
       $DB['VERIFY_HOST'] = true;
       $DB['CIPHER_LIST'] = '';
       ...

§³§Ö§â§Ó§Ö§â

§¥§Ñ §Ò§Ú§ã§ä§Ö §à§Þ§à§Ô§å?§Ú§Ý§Ú §ê§Ú§æ§â§à§Ó§Ñ?§Ö §ã§Ñ §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Þ §Ú §Ú§Õ§Ö§ß§ä§Ú§ä§Ö§ä§à§Þ §Õ§à§Þ§Ñ?§Ú§ß§Ñ §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ Áú»¢¶Ä²© §ã§Ö§â§Ó§Ö§â§Ñ §Ú §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ, §Ü§à§ß§æ§Ú§Ô§å§â§Ú§ê§Ú§ä§Ö /etc/zabbix/zabbix_server.conf:

...
       DBHost=10.211.55.9
       DBName=zabbix
       DBUser=zbx_srv
       DBPassword=<strong_password>
       DBTLSConnect=verify_full
       DBTLSCAFile=/etc/ssl/pgsql/root.crt
       DBTLSCertFile=/etc/ssl/pgsql/client.crt
       DBTLSKeyFile=/etc/ssl/pgsql/client.key
       ...