Documentation
Table of Contents
2. §¯§Ñ§ã§ä§â§à§Û§Ü§Ñ §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §Õ§Ý§ñ PostgreSQL
§°§Ò§Ù§à§â
§£ §ï§ä§à§Þ §â§Ñ§Ù§Õ§Ö§Ý§Ö §á§â§Ö§Õ§à§ã§ä§Ñ§Ó§Ý§Ö§ß§à §ß§Ö§ã§Ü§à§Ý§î§Ü§à §á§â§Ú§Þ§Ö§â§à§Ó §ß§Ñ§ã§ä§â§à§Ö§Ü §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§ñ §Õ§Ý§ñ CentOS 8.2 §Ú PostgreSQL 13.
§¦§ã§Ý§Ú §Ù§ß§Ñ§é§Ö§ß§Ú§Ö §á§à§Ý§ñ §·§à§ã§ä §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §ß§Ñ§é§Ú§ß§Ñ§Ö§ä§ã§ñ §ã §Ü§à§ã§à§Û §é§Ö§â§ä§í §Ú§Ý§Ú §ï§ä§à §á§à§Ý§Ö §á§å§ã§ä§à§Ö, §ä§à §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§ñ §Þ§Ö§Ø§Õ§å §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§à§Þ Áú»¢¶Ä²© §Ú PostgreSQL §ê§Ú§æ§â§à§Ó§Ñ§ß§ß§í§Þ§Ú §Ò§í§ä§î §ß§Ö §Þ§à§Ô§å§ä (§á§Ñ§â§Ñ§Þ§Ö§ä§â§í §Ó GUI §Ó§í§Ü§Ý§ð§é§Ñ§ð§ä§ã§ñ).
§±§â§Ö§Õ§Ó§Ñ§â§Ú§ä§Ö§Ý§î§ß§í§Ö §ä§â§Ö§Ò§à§Ó§Ñ§ß§Ú§ñ
§µ§ã§ä§Ñ§ß§à§Ó§Ú§ä§Ö §Ò§Ñ§Ù§å §Õ§Ñ§ß§ß§í§ç PostgreSQL, §Ú§ã§á§à§Ý§î§Ù§å§ñ .
?§ª§Ù §Ü§à§â§à§Ò§Ü§Ú? PostgreSQL §ß§Ö §ß§Ñ§ã§ä§â§à§Ö§ß §ß§Ñ §á§â§Ú§×§Þ TLS §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Û. §±§à§Ø§Ñ§Ý§å§Û§ã§ä§Ñ, §ã§Ý§Ö§Õ§å§Û§ä§Ö §Ú§ß§ã§ä§â§å§Ü§è§Ú§ñ§Þ §Ú§Ù §Õ§à§Ü§å§Þ§Ö§ß§ä§Ñ§è§Ú§Ú PostgreSQL §Õ§Ý§ñ , §Ñ §ä§Ñ§Ü§Ø§Ö §Õ§Ý§ñ §á§à§ã§â§Ö§Õ§ã§ä§Ó§à§Þ §æ§Ñ§Û§Ý§Ñ ph_hba.conf.
§±§à §å§Þ§à§Ý§é§Ñ§ß§Ú§ð, §ã§à§Ü§Ö§ä PostgreSQL §á§â§Ú§Ó§ñ§Ù§Ñ§ß §Ü localhost, §Õ§Ý§ñ §å§Õ§Ñ§Ý§×§ß§ß§í§ç §ã§Ö§ä§Ö§Ó§í§ç §á§à§Õ§Ü§Ý§ð§é§Ö§ß§Ú§Û §â§Ñ§Ù§â§Ö§ê§Ú§ä§Ö §á§â§à§ã§Ý§å§ê§Ú§Ó§Ñ§ß§Ú§Ö §ß§Ñ §â§Ö§Ñ§Ý§î§ß§à§Þ §ã§Ö§ä§Ö§Ó§à§Þ §Ú§ß§ä§Ö§â§æ§Ö§Û§ã§Ö.
§¯§Ñ§ã§ä§â§à§Û§Ü§Ú PostgreSQL §Õ§Ý§ñ §Ó§ã§Ö§ç §â§Ö§Ø§Ú§Þ§à§Ó §Þ§à§Ô§å§ä §Ó§í§Ô§Ý§ñ§Õ§Ö§ä§î §ã§Ý§Ö§Õ§å§ð§ë§Ú§Þ §à§Ò§â§Ñ§Ù§à§Þ:
/var/lib/pgsql/13/data/postgresql.conf:
...
ssl = on
ssl_ca_file = 'root.crt'
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'
ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
ssl_prefer_server_ciphers = on
ssl_min_protocol_version = 'TLSv1.3'
...§¥§Ý§ñ §Ü§à§ß§ä§â§à§Ý§ñ §Õ§à§ã§ä§å§á§Ñ §á§à§Õ§á§â§Ñ§Ó§î§ä§Ö /var/lib/pgsql/13/data/pg_hba.conf:
...
### require
hostssl all all 0.0.0.0/0 md5
### verify CA
hostssl all all 0.0.0.0/0 md5 clientcert=verify-ca
### verify full
hostssl all all 0.0.0.0/0 md5 clientcert=verify-full
...§²§Ö§Ø§Ú§Þ Required
§£§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã
§¹§ä§à§Ò§í §Ó§Ü§Ý§ð§é§Ú§ä§î §ä§à§Ý§î§Ü§à §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ß§Ñ §ä§â§Ñ§ß§ã§á§à§â§ä§ß§à§Þ §å§â§à§Ó§ß§Ö §Õ§Ý§ñ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Û §Þ§Ö§Ø§Õ§å §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§à§Þ Áú»¢¶Ä²© §Ú §Ò§Ñ§Ù§à§Û §Õ§Ñ§ß§ß§í§ç:
- §°§ä§Þ§Ö§ä§î§ä§Ö TLS §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç
- §°§ã§ä§Ñ§Ó§î§ä§Ö §µ§Õ§à§ã§ä§à§Ó§Ö§â§ñ§ä§î §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §ß§Ö§à§ä§Þ§Ö§é§Ö§ß§ß§í§Þ
§³§Ö§â§Ó§Ö§â
§¹§ä§à§Ò§í §Ó§Ü§Ý§ð§é§Ú§ä§î §ä§à§Ý§î§Ü§à §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ß§Ñ §ä§â§Ñ§ß§ã§á§à§â§ä§ß§à§Þ §å§â§à§Ó§ß§Ö §Õ§Ý§ñ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Û §Þ§Ö§Ø§Õ§å §ã§Ö§â§Ó§Ö§â§à§Þ Áú»¢¶Ä²© §Ú §Ò§Ñ§Ù§à§Û §Õ§Ñ§ß§ß§í§ç, §ß§Ñ§ã§ä§â§à§Û§ä§Ö /etc/zabbix/zabbix_server.conf:
...
DBHost=10.211.55.9
DBName=zabbix
DBUser=zbx_srv
DBPassword=<strong_password>
DBTLSConnect=required
...§²§Ö§Ø§Ú§Þ Verify CA
§£§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã
§¹§ä§à§Ò§í §Ó§Ü§Ý§ð§é§Ú§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ã §á§â§à§Ó§Ö§â§Ü§à§Û §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Õ§Ý§ñ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Û §Þ§Ö§Ø§Õ§å §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§à§Þ Áú»¢¶Ä²© §Ú §Ò§Ñ§Ù§à§Û §Õ§Ñ§ß§ß§í§ç:
- §°§ä§Þ§Ö§ä§î§ä§Ö TLS §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §Ú §µ§Õ§à§ã§ä§à§Ó§Ö§â§ñ§ä§î §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç
- §µ§Ü§Ñ§Ø§Ú§ä§Ö §á§å§ä§î §Ó §á§à§Ý§Ö §¶§Ñ§Û§Ý TLS CA §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç
§£ §Ü§Ñ§é§Ö§ã§ä§Ó§Ö §Ñ§Ý§î§ä§Ö§â§ß§Ñ§ä§Ú§Ó§í, §Þ§à§Ø§ß§à §Ó§í§ã§ä§Ñ§Ó§Ú§ä§î §Ó /etc/zabbix/web/zabbix.conf.php:
...
$DB['ENCRYPTION'] = true;
$DB['KEY_FILE'] = '';
$DB['CERT_FILE'] = '';
$DB['CA_FILE'] = '/etc/ssl/pgsql/root.crt';
$DB['VERIFY_HOST'] = false;
$DB['CIPHER_LIST'] = '';
...§³§Ö§â§Ó§Ö§â
§¹§ä§à§Ò§í §Ó§Ü§Ý§ð§é§Ú§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ã §á§â§à§Ó§Ö§â§Ü§à§Û §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Õ§Ý§ñ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Û §Þ§Ö§Ø§Õ§å §ã§Ö§â§Ó§Ö§â§à§Þ Áú»¢¶Ä²© §Ú §Ò§Ñ§Ù§à§Û §Õ§Ñ§ß§ß§í§ç, §ß§Ñ§ã§ä§â§à§Û§ä§Ö /etc/zabbix/zabbix_server.conf:
...
DBHost=10.211.55.9
DBName=zabbix
DBUser=zbx_srv
DBPassword=<strong_password>
DBTLSConnect=verify_ca
DBTLSCAFile=/etc/ssl/pgsql/root.crt
...§²§Ö§Ø§Ú§Þ Verify full
§£§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã
§¹§ä§à§Ò§í §Ó§Ü§Ý§ð§é§Ú§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ã §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Þ §Ú §á§â§à§Ó§Ö§â§Ü§à§Û §Ú§Õ§Ö§ß§ä§Ú§é§ß§à§ã§ä§Ú §å§Ù§Ý§Ñ §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §Õ§Ý§ñ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Û §Þ§Ö§Ø§Õ§å §Ó§Ö§Ò-§Ú§ß§ä§Ö§â§æ§Ö§Û§ã§à§Þ Áú»¢¶Ä²© §Ú §Ò§Ñ§Ù§à§Û §Õ§Ñ§ß§ß§í§ç:
- §°§ä§Þ§Ö§ä§î§ä§Ö TLS §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §Ú §µ§Õ§à§ã§ä§à§Ó§Ö§â§ñ§ä§î §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç
- §µ§Ü§Ñ§Ø§Ú§ä§Ö §á§å§ä§î §Ó §á§à§Ý§Ö §¶§Ñ§Û§Ý TLS §Ü§Ý§ð§é§Ñ §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç
- §µ§Ü§Ñ§Ø§Ú§ä§Ö §á§å§ä§î §Ó §á§à§Ý§Ö §¶§Ñ§Û§Ý TLS CA §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç
- §µ§Ü§Ñ§Ø§Ú§ä§Ö §á§å§ä§î §Ó §á§à§Ý§Ö §¶§Ñ§Û§Ý TLS §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§Ñ §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç
- §°§ä§Þ§Ö§ä§î§ä§Ö §³§Ó§Ö§â§Ü§Ñ §ç§à§ã§ä§Ñ §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç
§¬§Ñ§Ü §Ñ§Ý§î§ä§Ö§â§ß§Ñ§ä§Ú§Ó§Ñ, §Þ§à§Ø§ß§à §Ù§Ñ§Õ§Ñ§ä§î §Ó /etc/zabbix/web/zabbix.conf.php:
$DB['ENCRYPTION'] = true;
$DB['KEY_FILE'] = '';
$DB['CERT_FILE'] = '';
$DB['CA_FILE'] = '/etc/ssl/pgsql/root.crt';
$DB['VERIFY_HOST'] = true;
$DB['CIPHER_LIST'] = '';
...§³§Ö§â§Ó§Ö§â
§¹§ä§à§Ò§í §Ó§Ü§Ý§ð§é§Ú§ä§î §ê§Ú§æ§â§à§Ó§Ñ§ß§Ú§Ö §ã §ã§Ö§â§ä§Ú§æ§Ú§Ü§Ñ§ä§à§Þ §Ú §á§â§à§Ó§Ö§â§Ü§à§Û §Ú§Õ§Ö§ß§ä§Ú§é§ß§à§ã§ä§Ú §å§Ù§Ý§Ñ §Ò§Ñ§Ù§í §Õ§Ñ§ß§ß§í§ç §Õ§Ý§ñ §ã§à§Ö§Õ§Ú§ß§Ö§ß§Ú§Û §Þ§Ö§Ø§Õ§å §ã§Ö§â§Ó§Ö§â§à§Þ Áú»¢¶Ä²© §Ú §Ò§Ñ§Ù§à§Û §Õ§Ñ§ß§ß§í§ç, §ß§Ñ§ã§ä§â§à§Û§ä§Ö /etc/zabbix/zabbix_server.conf: