Connecting with PostgreSQL Client

This article describes specific database client requirements when connecting to databases using the PostgresSQL database protocol.

Supported PostgreSQL Protocol Versions

PrivX database proxy supports the latest postgreSQL protocol version 3.

Supported Configurations

PostgreSQL databases can be configured as host DB service to PrivX in three different ways:

Protocol: PostgreSQL and Account Type: Explicit

With this configuration:

• PrivX authenticates the database client connection with PrivX user password
• PrivX injects the target database user credentials to the protocol stream
• PrivX session records the decrypted postgreSQL protocol stream after authentication phase has completed
• psql client is required to use TLS
• In the target database's pg_hba.conf file, set the authentication method for connections from PrivX to scram-sha-256 (recommended) or password.

Protocol: PostgreSQL and Account Type: User-defined

With this configuration:

• PrivX forwards end user provided target database user credentials to database server
• PrivX session records the decrypted postgreSQL protocol stream after authentication phase has completed
• psql client is required to use TLS
• In the target database's pg_hba.conf file, set the authentication method for connections from PrivX to scram-sha-256 (recommended) or password.

Protocol: Passthrough and Account Type: User-defined

With this configuration:

• PrivX forwards unmodified raw protocol stream
• End user provided target database user credentials are sent in the protocol stream
• PrivX session records raw protocol stream. If the database client and server use TLS, the session recording will contain encrypted protocol stream. If the database client and server use unencrypted connections, any client provided database user credentials may end up in the session recordings, unless proper value for Audit Skip (Bytes) is configured to host DB service.
  tip

  Determine the Audit Skip (Bytes) value by testing with your database type and version. Verify that the excluded bytes cover the authentication exchange, including any database credentials. There is no universal recommended value because authentication and handshake protocols vary between databases.

Enabling TLS Server Certificate Validation

By default psql client uses sslmode=prefer setting. With this setting the server TLS certificate is not validated. To enable server TLS certificate validation, you need to use sslmode=verify-ca or sslmode=verify-full , and make the psql client trust the "PrivX Database Proxy CA".

To connect psql client to target database through PrivX using sslmode=verify-full:

1. Copy "PrivX Database Proxy CA" certificate from PrivX UI under Monitoring -> Certificates and store the CA certificate to a file (for example privx-db-proxy-ca.pem)
2. Configure psql client to verify server TLS certificate and to trust the CA:

$ psql "port=5432 host=localhost user=dbuser sslrootcert=privx-db-proxy-ca.pem sslmode=verify-full"