Advanced Authentication and Encrypted Connections
summary
Covers concrete setups: Kerberos/GSSAPI (ktpass/keytab on AD, kadmin/ktadd on MIT KDC), TLS client certificates with OpenSSL root/intermediate/server/client flows and combined server CRT, and SCRAM as the recommended password method while avoiding md5, PAM and LDAP-for-auth. Shows pg_hba patterns (hostssl + cert/map rules), libpq options like channel binding and SSL mode verify-full, Postgres 12 adds GSS encryption and Postgres 16 adds GSS delegation so delegated tickets can authenticate postgres_fdw, and practical CRL/OCSP handling.
AI-written summary · about
chapters (13)
- 0:00Introduction to talk
- 1:05Recommended authentication methods
- 6:22Unrecommended authentication methods
- 8:30PG HBA configuration overview
- 10:42Client-side security options
- 16:21Kerberos and GSS API explained
- 23:47GSS API encryption in PostgreSQL
- 24:51Kerberos delegation support
- 28:06SSPI in Windows environments
- 29:31Certificate Authority setup
- 33:23PostgreSQL with certificates
- 36:53Client-side certificate authentication
- 39:00Q&A session
related talks
54mConfiguration and Authentication
07mAll about Postgres security
35mSecuring PostgreSQL From External Attack
22mFrom trust to Tokens: A Short History of PostgreSQL Authentication
50mSecuring PostgreSQL
50mSecuring PostgreSQL From External Attack
35mThe Three Musketeers (Authentication, Authorization, and Accounting)
32mEnhancing Security in PostgreSQL