Connecting with PostgreSQL Client

This article describes client requirements and supported configurations for connecting to PostgreSQL databases through PrivX.

Supported PostgreSQL Protocol Versions

The PrivX database proxy supports PostgreSQL protocol version 3.

Supported Configurations

To configure a PostgreSQL database as a host DB service, go to Administration → Hosts in the PrivX Web UI and select the target host. Use one of the following three configurations.

PostgreSQL with Explicit Account

PrivX authenticates the database client connection using the PrivX user's password or session password and injects the target database user's credentials into the protocol stream. After authentication, PrivX records the decrypted PostgreSQL protocol stream.

To configure this connection:

1. Under Services, set Type to DB and Protocol to PostgreSQL.
2. Under Accounts, set Account Type to Explicit for the target database account.
3. Save the host settings.
4. In the target database's pg_hba.conf file, set the authentication method for connections from PrivX to scram-sha-256 (recommended) or password.
5. Configure the psql client to use TLS. For certificate validation instructions, see Enabling TLS Server Certificate Validation.

PostgreSQL with User-Defined Account

PrivX forwards the raw protocol stream without modification, including the target database credentials provided by the end user. After authentication, PrivX records the decrypted PostgreSQL protocol stream.

To configure this connection:

1. Under Services, set Type to DB and Protocol to PostgreSQL.
2. Under Accounts, set Account Type to User-defined.
3. Save the host settings.
4. In the target database's pg_hba.conf file, set the authentication method for connections from PrivX to scram-sha-256 (recommended) or password.
5. Configure the psql client to use TLS. For certificate validation instructions, see Enabling TLS Server Certificate Validation.

Passthrough with User-Defined Account

PrivX forwards and records the raw protocol stream without modification, including the target database credentials provided by the end user.

If the database client and server use TLS, session recordings contain the encrypted protocol stream. For unencrypted connections, recordings can include database credentials unless the authentication exchange is excluded.

To configure this connection:

1. Under Services, set Type to DB and Protocol to Passthrough. The Audit Skip (Bytes) field becomes available.
2. If the database client and server use an unencrypted connection, set Audit Skip (Bytes) to the number of bytes to exclude from the start of session recordings.
   tip

   Determine the Audit Skip (Bytes) value by testing with your database type and version. Verify that the excluded bytes cover the authentication exchange, including any database credentials. There is no universal recommended value because authentication and handshake protocols vary between databases.

3. Under Accounts, set Account Type to User-defined.
4. Save the host settings.

Enabling TLS Server Certificate Validation

By default, the psql client uses the sslmode=prefer setting, which does not validate the server's TLS certificate. To enable server TLS certificate validation, use sslmode=verify-ca or sslmode=verify-full and configure the psql client to trust the "PrivX Database Proxy CA".

To connect the psql client to a target database through PrivX using sslmode=verify-full, first establish the SSH tunnel described in the parent article, Database Connections with Native Clients. Then configure certificate validation:

1. In the PrivX Web UI, go to Monitoring → Certificates.
2. Copy the "PrivX Database Proxy CA" certificate and save it to a file, for example privx-db-proxy-ca.pem.
3. Configure the psql client to validate the server's TLS certificate using the saved CA certificate:

$ psql "port=5432 host=localhost user=dbuser sslrootcert=privx-db-proxy-ca.pem sslmode=verify-full"