KingbaseES V8R6 sslinfo 插件

前言

KingbaseES对使用SSL 连接加密客户端/服务器通讯的本地支持，可以增加数据传输安全性。

本文展示配置ssl连接，并通过安装一个插件验证ssl加密认证使用。

一、配置ssl连接过程：

ssl_library的参数值是OpenSSL

test=#show ssl_library ;
 ssl_library
-------------
 OpenSSL
(1 row)

test=# select version();
version
\----------------------------------------------------------------------------------------------------------------------
KingbaseES V008R006C006B0013 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 4.1.2 20080704 (Red Hat 4.1.2-46), 64-bit
(1 row)

想要我们的数据库支持SSL连接，首先需要确保服务器安装了openssl：

[kingbase2@localhost ~]$ openssl version -d
OPENSSLDIR: "/etc/pki/tls"

KingbaseES 数据库配置单向SSL认证连接

首先为服务器创建一个有效期为365天的自签名证书，创建服务端证书和私钥文件并授权：

mkdir ~/openssl

openssl req -new -x509 -days 365 -nodes -text -subj '/CN=kingbase' -out ~/openssl/server.crt -keyout ~/openssl/server.key

chmod 600 ~/openssl/server.key

修改kingbase.conf配置文件

ssl = on
ssl_cert_file = '/home/kingbase2/openssl/server.crt'
ssl_key_file = '/home/kingbase2/openssl/server.key'

启动数据库实例：
[kingbase2@localhost data]$ sys_ctl start
waiting for server to start....2022-12-02 11:24:32.053 CST [16431] LOG:  sepapower extension initialized
2022-12-02 11:24:32.054 CST [16431] LOG:  starting KingbaseES V008R006C006B0013 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 4.1.2 20080704 (Red Hat 4.1.2-46), 64-bit
2022-12-02 11:24:32.055 CST [16431] LOG:  listening on IPv4 address "0.0.0.0", port 2920
2022-12-02 11:24:32.055 CST [16431] LOG:  listening on IPv6 address "::", port 2920
2022-12-02 11:24:32.056 CST [16431] LOG:  listening on Unix socket "/tmp/.s.KINGBASE.2920"
2022-12-02 11:24:32.077 CST [16431] LOG:  redirecting log output to logging collector process
2022-12-02 11:24:32.077 CST [16431] HINT:  Future log output will appear in directory "sys_log".
 done
server started

[kingbase2@localhost data]$ ksql -h 127.0.0.1 -d test -Usystem -p2920
Password for user system:
ksql (V8.0)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.

注意连接时候需要加上-h参数，否则不以ssl方式连接。

二、插件实现方法

KingbaseES数据库可将以下内容添加到 kingbase.conf 文件的 shared_preload_libraries 中，重启数据库时自动加载。

shared_preload_libraries = 'sslinfo'

test=# select * from sys_available_extensions where name like 'ssl%';
  name   | default_version | installed_version |              comment
---------+-----------------+-------------------+------------------------------------
 sslinfo | 1.2             |                   | information about SSL certificates
(1 row)

test=# create extension sslinfo;
CREATE EXTENSION

test=# select * from ssl_is_used(), ssl_cipher();

ssl_is_used | ssl_cipher
-------------+-----------------------------
t | ECDHE-RSA-AES256-GCM-SHA384
(1 row)

test=# select * from pg_stat_ssl;
pid | ssl | version | cipher | bits | compression | client_dn | client_serial | issuer_dn
-------+-----+---------+-----------------------------+------+-------------+-----------+---------------+-----------
16437 | f | | | | | | |
16440 | f | | | | | | |
16442 | f | | | | | | |
16441 | f | | | | | | |
18551 | t | TLSv1.2 | ECDHE-RSA-AES256-GCM-SHA384 | 256 | f | | |
16435 | f | | | | | | |
16434 | f | | | | | | |
16436 | f | | | | | | |
(8 rows)

连接已成功加密。如果“ssl = true”，那么这么客户端已经使用ssl连接数据库。