Disabling non-SSL access to remote DBaaS on Azure
Before you begin
Cloudscale PostgreSQL clients must be FIPS compliant.
PostgreSQL clients require password authentication.
Note:
Microsoft Azure limitation: Remote PostgreSQL on Azure defaults to instead of password authentication at the time of creation.
To use password authentication, the PostgreSQL clients must connect to the database server with SSL and re-encrypt the password using the following procedure. This switches the database server to use password authentication.
Manually disabling the non-SSL access to remote PostgreSQL on Azure
- Launch an Azure CLI pod into the AKS cluster using the following command:
$ kubectl run az-cli --image=mcr.microsoft.com/azure-cli --command sleep infinity
- Exec into the Azure CLI pod as follows:
$ kubectl exec -it az-cli -- /bin/ash
- From Azure CLI pod, log into Azure account:
$ az login --scope https://graph.microsoft.com//.default
- (Optional) Create a key vault policy to allow the current user to retrieve the database credential.
Obtain the name of your resource group, key vault and ID of the current user by using the following respective commands:
Resource group name:
$ RESOURCE_GROUP=<resource_group_name>
Key vault name:
$ az keyvault list --resource-group $RESOURCE_GROUP --resource-type vault | jq -r '.[].name'
Current user ID name:
$ az account show | jq -r '.user.name'
Create a key vault access policy as follows:
$ az keyvault set-policy -n $KEY_VAULT_NAME --upn $USER_ID --resource-group $RESOURCE_GROUP --secret-permissions get
- Obtain the login name for the key vault (DBADMINUSER):
$ DBADMINUSER=$(az keyvault secret show --vault-name $KEY_VAULT_NAME --name dbadminlogin | jq -r .value)
- Obtain the password for the key vault (DBADMINPASSWORD):
$ az keyvault secret show --resource-group $RESOURCE_GROUP --vault-name $USER_ID --name dbadminpassword
- Re-encrypt the password.
Re-encrypting the password requires the database server name. Obtain the database server name using the following command:
$ az postgres flexible-server list --resource-group $RESOURCE_GROUP | jq -r '.[].name'
Use the following command to re-encrypt the password:
$ az postgres flexible-server execute -p '$DBADMINPASSWORD' -u $DBADMINUSER -n $DBSERVER -d postgres -q "ALTER USER\"nbdbadmin\" WITH PASSWORD '$DBADMINPASSWORD';"
- Use the following command to disable non-SSL access:
$ az postgres flexible-server parameter set --resource-group $RESOURCE_GROUP --server-name DBSERVER --name require_secure_transport --value on
- Use the following command to verify if non-SSL access is disabled:
$ az postgres flexible-server parameter show --resource-group $RESOURCE_GROUP --server-name $DBSERVER --name require_secure_transport | jq -r 'value'
- Delete the key vault access policy created in step 4 above:
$ az keyvault delete-policy -n $KEYVAULT --upn $USER_ID
- Exit from the azure CLI pod:
$ exit
- Delete the az CLI pod:
$ kubectl delete pod az-cli