Red Hat Training
A Red Hat training course is available for Red Hat Satellite
4.3. Configuring the PostgreSQL Database to use SSL
By default, Satellite connects to the PostgreSQL database through an unencrypted communication. However, you can set up your database connection to use SSL. An SSL connection encrypts communication between the Satellite and the database, which is an advantage if using a Managed or External database over a wide area network.
To enable SSL communication between the Satellite Server and PosgreSQL database server, complete the following procedures:
Prequisites
To enable SSL communication between the Satellite Server and PosgreSQL database server, you require the following. Consult your preferred Certificate Authority's documentation for instructions on how to create these files.
- An SSL certificate for the Satellite Server, signed by a Certificate Authority. In the following procedures, the example filename is
server.crt
. - The private key with which you signed the certificate. In the following procedures, the example filename is
server.key
. - The Certificate Authority's certificate with which the certificate was signed. In the following procedures, the example filename is
root-ca.cert
.
Stop all Satellite services before configuring the database to use SSL.
[root@satellite ~]# spacewalk-service stop
Procedure 4.1. Configuring SSL on the database server
- Login to the database server as
root
. - Copy your signed certificate and private key to the required locations on the database server:
[root@database~]# cp server.{key,crt} /var/opt/rh/rh-postgresql95/lib/pgsql/data/. [root@database~]# chown postgres:postgres /var/opt/rh/rh-postgresql95/lib/pgsql/data/server.{key,crt} [root@database~]# chmod 0400 /var/opt/rh/rh-postgresql95/lib/pgsql/data/server.key
- Edit the
postgresql.conf
file and add the following option:ssl=on
- Edit the
pg_hba.conf
file. This file is a permissions file for restricting access to the database. Look for a line similar to the following:host mydb mydbuser 192.168.122.0/24 md5
This line should contain your database name, database user, and IP address or range that allows connections. Change thehost
option tohostssl
:hostssl mydb mydbuser 192.168.122.0/24 md5
This changes the incoming communication protocol to use SSL and refuse any unencrypted PostgreSQL connections. - Restart the
rh-postgresql95-postgresql
service so the changes take effect:[root@database~]# service rh-postgresql95-postgresql restart
The database server now only accepts connections from clients using SSL. The next procedure sets up the Satellite Server to communicate with the database using SSL.
Procedure 4.2. Configuring SSL on the Satellite Server
- Login to the Satellite Server as
root
. - Copy your
root-ca.cert
certificate:[root@satellite ~]# cp root-ca.cert /etc/rhn/postgresql-db-root-ca.cert
- Edit the
/etc/rhn/rhn.conf
file and add the following option:db_ssl_enabled = 1
- Add the certificate to Satellite's Java web server keystore:
[root@satellite ~]# openssl x509 -in /etc/rhn/postgresql-db-root-ca.cert -out server.der -outform der [root@satellite ~]# keytool -keystore /etc/rhn/javatruststore.jks -alias postgresql -import -file server.der [root@satellite ~]# rm server.der
Important
The/etc/rhn/javatruststore.jks
requires a password for any modifications to the keystore. Change this password if necessary using the following command:[root@satellite ~]# keytool -storepasswd -keystore /etc/rhn/javatruststore.jks
- Restore the SELinux context of the new certificate files:
[root@satellite ~]# restorecon -R -F -v /etc/rhn/
- Start the Satellite services:
[root@satellite ~]# spacewalk-service start
The Satellite Server now communicates with the database server using SSL.