0

The Goal

What I want to do is accessing a remote PostgreSQL database over SSL.

The problem

The database serverhas no own certificate.

The whole picture

We have two different servers which run versions of the same webapp.

The first (let's call it Fizz) has a SSL certificate, runs nginx and the webapp is accessible (only) via HTTPS.

The second one (Buzz) has no SSL certificate.
To provide a somehow secure connection the webapp is accessible only over Fizz's SSL connection.
For this to work Fizz's nginx is configured to proxy Buzz's webapp through it's own SSL connection.
HTTP(S) connections from other machines are refused by Buzz.

This means https://fizz/A shows Fizz's webapp and https://fizz/B shows Buzz's.

This works fine.

But now we need secure access to the (postgres) database running on Buzz.

Since we have on top of all a company firewall running I can't access it directly, but it works over SSH tunneling.

If I want access via SSL I have to access it via the Fizz. And I don't know how. I hoped I could configure nginx to do something similar to what is does to the webapps.

Is this even possible? I'm not sure how to configure that. All information I find on the net refer to http and webserver.

Or is there some other way, maybe SSH/SSL tunnel to Fizz and redirect the traffic to Buzz?

I'm a little lost.

Edit 2016-09-22

I made a picture to make the situation a little more clear (hopefully): Diagram The green path is what is working. I can access Fizz over https and nginx establishes the connection to Buzz which delivers the webapp.

The orange path is what I'd like to do. Basically the same thing, but not with a website, but with a database connection.

And I'm not sure if it is possible with nginx.

Edit 2016-09-23

Based on Tims link I now set this up:

The SSH tunnel to get around the proxy:

5443:localhost:5443

as well as a nginx rule:

stream {
    listen 5443 ssl;
    proxy_pass buzz:5432
}

The idea:

  • establish an ssh connection to Fizz
  • open a tunnel 5443:localhost:5443
  • let the client connect to localhost:5443
  • let nginx listen to 5443 and
  • redirect it to Buzz:5432

which is the port the database listens to.

Testing the connection with ncat returns Close: Result too large

So I'm not sure, until where the connection works.

  • Your question is really unclear and difficult to follow. If you want to add SSL to a server just buy or otherwise procure a certificate (eg free with Let's Encrypt), install it, and configure it to be used by applicable software. – Tim Sep 21 '16 at 19:41
  • @Tim: I'm sorry, the question is unclear. But it is a rather strange configuration. I guess if it is necessary, my company will buy a new certificate. But for now my task is to try it this way. – Robin Koch Sep 22 '16 at 13:06
  • konch - would a concise problem statement be "I would like to give public access to a PostgreSQL database via an Nginx proxy running on port 443"? Would this be a tunnel or would you change the default listen port of 5432? Or would you like Nginx to listen on port 5432? If so this probably answers your question : stackoverflow.com/questions/35545648/… – Tim Sep 22 '16 at 20:06
  • @Tim: That seems to be related. I've tried using streams to redirect the incoming connection, but I'm not sure if my connection gets through, though. Using ncat to test the connection I get a close: Result too large pgAdmin refuses a connection with "server closed the connection unexpectedly". – Robin Koch Sep 23 '16 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.