5.5. Configuring the PostgreSQL Database to use SSL

Procedure 5.1. Configuring SSL on the database server

1. Login to the database server as root.
2. Copy your signed certificate and private key to the required locations on the database server:

   [root@database~]# cp server.{key,crt} /opt/rh/postgresql92/root/var/lib/pgsql/data/.
   [root@database~]# chown postgres:postgres /opt/rh/postgresql92/root/var/lib/pgsql/data/server.{key,crt}
   [root@database~]# chmod 0400 /opt/rh/postgresql92/root/var/lib/pgsql/data/server.key
   

3. Edit the postgresql.conf file and add the following option:

   ssl=on
   

4. Edit the pg_hba.conf file. This file is a permissions file for restricting access to the database. Look for a line similar to the following:

   host    mydb mydbuser 192.168.122.0/24 md5
   

   This line should contain your database name, database user, and IP address or range that allows connections. Change the host option to hostssl:

   hostssl mydb mydbuser 192.168.122.0/24 md5
   

   This changes the incoming communication protocol to use SSL and refuse any unencrypted PostgreSQL connections.
5. Restart the postgresql service so the changes take effect:

   [root@database~]# service postgresql92-postgresql restart
   

Procedure 5.2. Configuring SSL on the Satellite server

1. Login to the Satellite server as root.
2. Copy your root-ca.cert certificate to the following location:

   [root@satellite ~]# cp root-ca.cert /etc/rhn/postgresql-db-root-ca.cert
   

3. Edit the /etc/rhn/rhn.conf file and add the following option:

   db_ssl_enabled = 1
   

4. Add the certificate to Satellite's Java web server keystore:

   [root@satellite ~]# openssl x509 -in /etc/rhn/postgresql-db-root-ca.cert -out server.der -outform der
   [root@satellite ~]# keytool -keystore /etc/rhn/javatruststore.jks -alias postgresql -import -file server.der
   [root@satellite ~]# rm server.der
   

   Important

   The /etc/rhn/javatruststore.jks requires a password for any modifications to the keystore. Change this password if necessary using the following command:

   [root@satellite ~]# keytool -storepasswd -keystore /etc/rhn/javatruststore.jks
   

5. Restore the SELinux context of the new certificate files:

   [root@satellite ~]# restorecon -R -F -v /etc/rhn/
   

6. Start the Satellite services:

   [root@satellite ~]# spacewalk-service start