gatewayd icon indicating copy to clipboard operation
gatewayd copied to clipboard

`server`: TLS termination of outgoing connection to the database server

Open mostafa opened this issue 2 years ago • 0 comments

The idea is to have GatewayD connect to Postgres via SSL, so that the clients can initiate authentication over a secure channel. If TLS is enabled on GatewayD, and TLS termination is enabled on outgoing connection to Postgres, GatewayD acts as a TLS broker. The traffic inside GatewayD is in plaintext, unless TLS termination is disabled or encryption is not enforced by the client/server.

Update: There are some WIP changes on this branch. I tried to take the same approach for the server, but it didn't work as expected, because Postgres asks for SCRAM authentication right after TLS handshake, which confuses the clients (psql), as they do not expect it. I will pick this up after the AAA plugin is developed.

mostafa avatar Nov 05 '23 01:11 mostafa