目標____HTMLTAG_66__HTMLTAG_67___學完本課後，您將：___HTMLTAG_68__HTMLTAG_69__HTMLTAG_70___為 PostgreSQL 實作 SSL/TLS加密____HTMLTAG_71__HTMLTAG_72___配置安全性驗證___HTMLTAG_73__HTMLTAG_74___強化網路安全性___HTMLTAG_75__HTMLTAG_76___啟用靜態加密____H TMLTAG_77__HTMLTAG_78___設定日誌審核___HTMLTAG_79__HTMLTAG_80___應用HA叢集的安全最佳實務___HTMLTAG_81__HTMLTAG_82__HTMLTAG_83___1。 SSL/TLS 加密___HTMLTAG_84__HTMLTAG_85___1.1。產生 SSL 憑證___HTMLTAG_86__CODEBLOCK_0__HTMLTAG_87___1.2。為 SSL 設定 PostgreSQL____HTMLTAG_88__CODEBLOCK_1__CODEBLOCK_2__HTMLTAG_89___1.3。為 SSL___HTMLTAG_90__CODEBLOCK_3__HTMLTAG_91___1.4 設定 pg_hba.conf。測試 SSL 連線___HTMLTAG_92__CODEBLOCK_4__HTMLTAG_93___1.5。用戶端憑證驗證
# Generate client certificate sudo openssl genrsa -out client-key.pem 4096 sudo openssl req -new -key client-key.pem -out client-req.pem
-subj "/CN=app_user/O=MyOrg/C=US" sudo openssl x509 -req -in client-req.pem -days 365
-CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial
-out client-cert.pemCopy to client machine
scp client-*.pem app_user@app-server:~/.postgresql/
# pg_hba.conf - require client cert hostssl all all 0.0.0.0/0 certConnect with client cert
psql "host=10.0.1.11 dbname=postgres user=app_user
sslmode=verify-full
sslcert=/.postgresql/client-cert.pem/.postgresql/client-key.pem
sslkey=
sslrootcert=~/.postgresql/ca-cert.pem"
2。驗證___HTMLTAG_96__HTMLTAG_97___2.1。 SCRAM-SHA-256（建議）___HTMLTAG_98__CODEBLOCK_7______CODEBLOCK_8__HTMLTAG_99___2.2。停用弱身份驗證___HTMLTAG_100__CODEBLOCK_9__HTMLTAG_101___2.3。密碼政策___HTMLTAG_102__CODEBLOCK_10__HTMLTAG_103___2.4。基於角色的存取控制___HTMLTAG_104__CODEBLOCK_11__HTMLTAG_105___3。網路安全___HTMLTAG_106__HTMLTAG_107___3.1。防火牆配置
___CODEBLOCK_13__HTMLTAG_109___3.2。網路分段___HTMLTAG_110__CODEBLOCK_14__HTMLTAG_111___3.3。 VPN/專用網路___HTMLTAG_112__CODEBLOCK_15__HTMLTAG_113___4。靜態加密___HTMLTAG_114__HTMLTAG_115___4.1。檔案系統加密 (LUKS)___HTMLTAG_116__CODEBLOCK_16__HTMLTAG_117___4.2。透明資料加密 (TDE)__HTMLTAG_118__CODEBLOCK_17__HTMLTAG_119___4.3。列級加密___HTMLTAG_120__CODEBLOCK_18__HTMLTAG_121___5。審核日誌記錄___HTMLTAG_122__HTMLTAG_123___5.1。 pgAudit擴充# Using ufw sudo ufw default deny incoming sudo ufw default allow outgoingAllow SSH
sudo ufw allow 22/tcp
Allow PostgreSQL only from specific IPs
sudo ufw allow from 10.0.1.0/24 to any port 5432 proto tcp
Allow Patroni REST API (internal only)
sudo ufw allow from 10.0.1.0/24 to any port 8008 proto tcp
Allow etcd (internal only)
sudo ufw allow from 10.0.1.0/24 to any port 2379 proto tcp sudo ufw allow from 10.0.1.0/24 to any port 2380 proto tcp
Enable firewall
sudo ufw enable sudo ufw status
# Install pgAudit sudo apt-get install -y postgresql-18-pgauditOr compile from source
cd /tmp git clone https://github.com/pgaudit/pgaudit.git cd pgaudit make install USE_PGXS=1
-- Enable pgAudit ALTER SYSTEM SET shared_preload_libraries = 'pgaudit';
-- Restart required
sudo systemctl restart patroni
-- Change server_version_num (cosmetic security)
-- Note: Doesn't actually hide from determined attackers
ALTER SYSTEM SET application_name = 'myapp';