small clairifcation

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

small clairifcation

PG Doc comments form
The following documentation comment has been logged on the website:

Page: https://www.postgresql.org/docs/9.5/ssh-tunnels.html
Description:

"The first number in the -L argument, 63333, is the port number of your end
of the tunnel; it can be any unused port. (IANA reserves ports 49152 through
65535 for private use.) The second number, 5432, is the remote end of the
tunnel: the port number your server is using. "
as a beginner This took me some time to understand what do you mean by "your
server" "your end of the tunnel "
Reply | Threaded
Open this post in threaded view
|

Re: small clairifcation

Tom Lane-2
PG Doc comments form <[hidden email]> writes:
> The following documentation comment has been logged on the website:
> Page: https://www.postgresql.org/docs/9.5/ssh-tunnels.html
> Description:

> "The first number in the -L argument, 63333, is the port number of your end
> of the tunnel; it can be any unused port. (IANA reserves ports 49152 through
> 65535 for private use.) The second number, 5432, is the remote end of the
> tunnel: the port number your server is using. "

> as a beginner This took me some time to understand what do you mean by "your
> server" "your end of the tunnel "

Hm, do you have a suggestion for better wording?

                        regards, tom lane


Reply | Threaded
Open this post in threaded view
|

Re: small clairifcation

David G Johnston
On Thu, Aug 27, 2020 at 6:17 PM Tom Lane <[hidden email]> wrote:
PG Doc comments form <[hidden email]> writes:
> The following documentation comment has been logged on the website:
> Page: https://www.postgresql.org/docs/9.5/ssh-tunnels.html
> Description:

> "The first number in the -L argument, 63333, is the port number of your end
> of the tunnel; it can be any unused port. (IANA reserves ports 49152 through
> 65535 for private use.) The second number, 5432, is the remote end of the
> tunnel: the port number your server is using. "

> as a beginner This took me some time to understand what do you mean by "your
> server" "your end of the tunnel "

Hm, do you have a suggestion for better wording?


I agree on the need for a different perspective here since it reads just fine once you know what it is talking about.

But absent that maybe a slightly more tutorial flow would be good.

```
First make sure you can connect to the remote machine that is able to access the PostgreSQL server (in this example the PostgreSQL server is running on said remote machine).

local> ssh [hidden email]

Once connected, confirm that while on that machine you are able to connect to the PostgreSQL server via psql.

remote> psql -h localhost -p 5432 postgres

Now that we have confirmed that the two seperate parts are working, the ssh connection and the psql connection, we can create a tunnel so that we can execute psql on our local machine but have the PostgreSQL server see the inbound connection as coming from the remote machine.  To do this we need to set up a server-like process on the local machine to accept the connection from psql and then transmit the data to the remote machine.  Since psql is looking for a port number to connect to, 5432 when executed on the remote machine, we need to specify which one to use on the local machine.  For this example we choose 63333 (it can be any number between 49152 and 65535, and must not be in use already [footnote if more detail is desired]).  We are, in effect, merging the ssh and psql commands above into a hybrid command that maps the remote psql location information to a local address and port.  ssh, in this tunnel mode, always just listens to its loopback address so only the local port (6333) is required; but both the remote host (which is using its own loopback address - the localhost thus refers to this) and port (5432) are needed as that end of the tunnel can point anywhere visible to the remote machine (foo.com).

local> ssh -L 63333:localhost:5432 [hidden email]

Now we locally launch psql, connecting to localhost:63333, and ssh on foo.com proxies the stream to its localhost:5432 connection.

local> psql -h localhost -p 63333
```

I haven't considered how or whether the more advanced details would change if we expand upon and reword the basic section to be more like the above.

I am curious about whether and why this method absolutely guarantees that the resultant connection within the tunnel is not SSL-encrypted.

David J.


Reply | Threaded
Open this post in threaded view
|

Re: small clairifcation

Bruce Momjian
On Thu, Aug 27, 2020 at 09:51:49PM -0700, David G. Johnston wrote:

> On Thu, Aug 27, 2020 at 6:17 PM Tom Lane <[hidden email]> wrote:
>
>     PG Doc comments form <[hidden email]> writes:
>     > The following documentation comment has been logged on the website:
>     > Page: https://www.postgresql.org/docs/9.5/ssh-tunnels.html
>     > Description:
>
>     > "The first number in the -L argument, 63333, is the port number of your
>     end
>     > of the tunnel; it can be any unused port. (IANA reserves ports 49152
>     through
>     > 65535 for private use.) The second number, 5432, is the remote end of the
>     > tunnel: the port number your server is using. "
>
>     > as a beginner This took me some time to understand what do you mean by
>     "your
>     > server" "your end of the tunnel "
>
>     Hm, do you have a suggestion for better wording?
>
>
>
> I agree on the need for a different perspective here since it reads just fine
> once you know what it is talking about.
>
> But absent that maybe a slightly more tutorial flow would be good.
I didn't think a tutorial flow was the right thing to here, so I
reworded the section to be more details and have a clearer flow ---
patch attached.

--
  Bruce Momjian  <[hidden email]>        https://momjian.us
  EnterpriseDB                             https://enterprisedb.com

  The usefulness of a cup is in its emptiness, Bruce Lee


ssh.diff (3K) Download Attachment