May 2019
Intermediate to advanced
600 pages
20h 46m
English
You can leave the choice of whether or not to use SSL up to the client, or you can force SSL usage from the server side.
To let the client choose, use a line of the following form in the pg_hba.conf file:
host database user IP-address/IP-mask auth-method
If you want to allow only SSL clients, use the hostssl keyword instead of host.
The contents of pg_hba.conf can be seen using the pg_hba_file_rules view.
The following fragment of pg_hba.conf enables both non-SSL and SSL connections from the 192.168.1.0/24 local subnet, but requires SSL from everybody accessing the database from other networks:
host all all 192.168.1.0/24 md5 hostssl all all 0.0.0.0/0 md5
Read now
Unlock full access