无法建立 Postgres SSL 连接答案

【问题标题】：Postgres SSL connection failing to be established无法建立 Postgres SSL 连接
【发布时间】：2014-01-20 23:24:02
【问题描述】：

我正在尝试建立一个 vagrant 环境来运行一个 Rails 应用程序，该应用程序连接到 Heroku 上托管的远程 Postgres 数据库。从我的主机（Mac OS X）运行该应用程序运行良好，但在我的 vagrant box 中安装全新的 Ubuntu 时失败，即使它们指向相同的源目录。这是我尝试启动 Web 服务器时得到的结果：

00:02:22 web.1  | Connecting to database specified by database.yml
00:02:22 web.1  | /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/postgresql_adapter.rb:1216:in `initialize': FATAL:  no pg_hba.conf entry for host "207.172.212.123", user "user", database "database", SSL off (PG::ConnectionBad)
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/postgresql_adapter.rb:1216:in `new'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/postgresql_adapter.rb:1216:in `connect'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/postgresql_adapter.rb:324:in `initialize'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/postgresql_adapter.rb:28:in `new'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/postgresql_adapter.rb:28:in `postgresql_connection'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:315:in `new_connection'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:325:in `checkout_new_connection'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:247:in `block (2 levels) in checkout'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:242:in `loop'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:242:in `block in checkout'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/2.0.0/monitor.rb:211:in `mon_synchronize'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:239:in `checkout'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:102:in `block in connection'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/2.0.0/monitor.rb:211:in `mon_synchronize'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:101:in `connection'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/connection_adapters/abstract/connection_pool.rb:410:in `retrieve_connection'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/composite_primary_keys-5.0.13/lib/composite_primary_keys/connection_adapters/abstract/connection_specification_changes.rb:47:in `retrieve_connection'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/composite_primary_keys-5.0.13/lib/composite_primary_keys/connection_adapters/abstract/connection_specification_changes.rb:29:in `connection'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activerecord-3.2.13/lib/active_record/railtie.rb:88:in `block in <class:Railtie>'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/railties-3.2.13/lib/rails/initializable.rb:30:in `instance_exec'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/railties-3.2.13/lib/rails/initializable.rb:30:in `run'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/railties-3.2.13/lib/rails/initializable.rb:55:in `block in run_initializers'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/railties-3.2.13/lib/rails/initializable.rb:54:in `each'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/railties-3.2.13/lib/rails/initializable.rb:54:in `run_initializers'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/railties-3.2.13/lib/rails/application.rb:136:in `initialize!'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/railties-3.2.13/lib/rails/railtie/configurable.rb:30:in `method_missing'
00:02:22 web.1  |   from /vagrant/config/environment.rb:5:in `<top (required)>'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activesupport-3.2.13/lib/active_support/dependencies.rb:251:in `require'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activesupport-3.2.13/lib/active_support/dependencies.rb:251:in `block in require'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activesupport-3.2.13/lib/active_support/dependencies.rb:236:in `load_dependency'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/activesupport-3.2.13/lib/active_support/dependencies.rb:251:in `require'
00:02:22 web.1  |   from config.ru:4:in `block in <main>'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/rack-1.4.5/lib/rack/builder.rb:51:in `instance_eval'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/rack-1.4.5/lib/rack/builder.rb:51:in `initialize'
00:02:22 web.1  |   from config.ru:1:in `new'
00:02:22 web.1  |   from config.ru:1:in `<main>'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/unicorn-4.6.3/lib/unicorn.rb:48:in `eval'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/unicorn-4.6.3/lib/unicorn.rb:48:in `block in builder'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/unicorn-4.6.3/lib/unicorn/http_server.rb:722:in `call'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/unicorn-4.6.3/lib/unicorn/http_server.rb:722:in `build_app!'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/unicorn-4.6.3/lib/unicorn/http_server.rb:140:in `start'
00:02:22 web.1  |   from /opt/ruby/lib/ruby/gems/2.0.0/gems/unicorn-4.6.3/bin/unicorn:126:in `<top (required)>'
00:02:22 web.1  |   from /opt/ruby/bin/unicorn:23:in `load'
00:02:22 web.1  |   from /opt/ruby/bin/unicorn:23:in `<main>'
00:02:22 web.1  | exited with code 1

我认为这个问题与 pg gem 没有成功建立与 Postgres 的 SSL 连接有关。是否需要在 Ubuntu 服务器上配置一些特殊的东西才能实现 SSL 连接？

这里是database.yml：

  adapter: postgresql
  encoding: unicode
  pool: 5
  database: database
  username: user
  password: password
  host: xxx-xxx-xxx-xxx.compute-1.amazonaws.com
  port: 5432

此配置适用于我的 Mac，但不适用于 Ubuntu VM。我也尝试添加 sslmode: require，但也没有帮助。

【问题讨论】：

postgresql.org/docs/current/static/ssl-tcp.html
@CraigRinger 该文档似乎更侧重于服务器端需求，而不是客户端。我正在连接到通过 Heroku 托管的数据库，它使用 SSL 在我的 Mac 上工作，而不是来自 Ubuntu。关于为什么来自 Ubuntu 服务器的客户端无法使用 SSL 连接的任何想法？
啊，好的。通常的问题是人们没有配置 SSL 服务器端。如果您使用的是 Heroku（您在任何地方都没有提到，只有“ubuntu 服务器”，这表明您是自托管 Pg），这不是问题。
@CraigRinger 我将问题更新为更清晰。
问题出在第一行。这与 Ruby、gems 或 Rails 无关。您的 Postgres 服务器拒绝连接。我没有答案，但它与 Postgres 权限有关。

标签： ruby-on-rails postgresql ubuntu heroku

【解决方案1】：

关键错误部分是：

致命：主机“207.172.212.123”、用户“user”、数据库“database”没有 pg_hba.conf 条目，SSL 关闭

这告诉您您没有尝试建立 SSL 连接。您需要通过找到将sslmode 参数传递给@987654326 的方法来明确告诉libpq（这是Pg gem 以及Rails 用来连接到PostgreSQL 的东西）您需要SSL 连接@ 值为require。

This question 建议修改 Pg gem 以自动协商 SSL。所以猜测一下，你 Mac 上的版本比你的 Ubuntu 机器上的版本新。对于旧版本，似乎可能没有一种简单的方法来指定需要 SSL，但是根据该文章的第一个答案，可以使用带有 ssl=true 的连接字符串的 JDBC URL 格式来解决这个问题，但这有点难看。

您的 cmets 建议您的 Pg gem 不理解 sslmode 作为 database.yml 中的选项，默默地忽略它。

在这种情况下，我会尝试使用连接字符串：

 adapter: postgresql
 database: "dbname=database host=207.172.212.123 user=user sslmode=require"
 ...

一般来说，您可以在任何可以使用libpq 放置数据库名称的地方提供连接字符串。如果您这样做，您应该在您的database.yml 中省略user、host 等键。我没有用 Rails 测试过，但这种方法适用于大多数情况。

或者您可以将您的 Pg gem 更新为正确支持 SSL 的。它看起来像 the current version should support sslmode 作为连接选项。

更新：

事实证明，Ubuntu 机器上的 libpq 不支持 SSL。

【讨论】：

我将尝试对 database.yml 进行更改，但两种设置都使用 pg gem 的 0.17.1 版本，正如它们共享的 Gemfile.lock 中所指定的那样。
@ChrisJackson 这让事情变得更有趣了。 libpq中不同的编译时默认值？你的 Ubuntu 机器上的 libpq 是否支持 SSL？试试psql "dbname=database host=207.172.212.123 user=user sslmode=require"（对真实细节进行适当的更改）。
可能在这里，我从 Ubuntu 服务器得到这个：“psql: sslmode value "require" invalid when SSL support is not compiled in”。但是，我的 Mac 上的相同命令成功连接，所以这是区别因素。
好的，运行这些命令就可以了： sudo add-apt-repository ppa:pitti/postgresql sudo apt-get update sudo apt-get install postgresql-9.2 -y
@ChrisJackson 所以这是一个构建问题。一般来说，我建议使用来自apt.postgresql.org 的 PostgreSQL 包，而不是一些随机的 PPA，但很高兴你能成功。