5.5. Configuring the PostgreSQL Database to use SSL

Procedure 5.1. Configuring SSL on the database server

1. Login to the database server as root.
2. Copy your signed certificate and private key to the required locations on the database server:

   [root@database~]# cp server.{key,crt} /opt/rh/postgresql92/root/var/lib/pgsql/data/.
   [root@database~]# chown postgres:postgres /opt/rh/postgresql92/root/var/lib/pgsql/data/server.{key,crt}
   [root@database~]# chmod 0400 /opt/rh/postgresql92/root/var/lib/pgsql/data/server.key
   

   Copy to Clipboard Toggle word wrap
3. Edit the postgresql.conf file and add the following option:

   ssl=on
   

   Copy to Clipboard Toggle word wrap
4. Edit the pg_hba.conf file. This file is a permissions file for restricting access to the database. Look for a line similar to the following:

   host    mydb mydbuser 192.168.122.0/24 md5
   

   Copy to Clipboard Toggle word wrap
   This line should contain your database name, database user, and IP address or range that allows connections. Change the host option to hostssl:

   hostssl mydb mydbuser 192.168.122.0/24 md5
   

   Copy to Clipboard Toggle word wrap
   This changes the incoming communication protocol to use SSL and refuse any unencrypted PostgreSQL connections.
5. Restart the postgresql service so the changes take effect:

   [root@database~]# service postgresql92-postgresql restart
   

   Copy to Clipboard Toggle word wrap

Procedure 5.2. Configuring SSL on the Satellite server

1. Login to the Satellite server as root.
2. Copy your root-ca.cert certificate to the following location:

   [root@satellite ~]# cp root-ca.cert /etc/rhn/postgresql-db-root-ca.cert
   

   Copy to Clipboard Toggle word wrap
3. Edit the /etc/rhn/rhn.conf file and add the following option:

   db_ssl_enabled = 1
   

   Copy to Clipboard Toggle word wrap
4. Add the certificate to Satellite's Java web server keystore:

   [root@satellite ~]# openssl x509 -in /etc/rhn/postgresql-db-root-ca.cert -out server.der -outform der
   [root@satellite ~]# keytool -keystore /etc/rhn/javatruststore.jks -alias postgresql -import -file server.der
   [root@satellite ~]# rm server.der
   

   Copy to Clipboard Toggle word wrap

   Important

   The /etc/rhn/javatruststore.jks requires a password for any modifications to the keystore. Change this password if necessary using the following command:

   [root@satellite ~]# keytool -storepasswd -keystore /etc/rhn/javatruststore.jks
   

   Copy to Clipboard Toggle word wrap
5. Restore the SELinux context of the new certificate files:

   [root@satellite ~]# restorecon -R -F -v /etc/rhn/
   

   Copy to Clipboard Toggle word wrap
6. Start the Satellite services:

   [root@satellite ~]# spacewalk-service start
   

   Copy to Clipboard Toggle word wrap