‫What is going on, guys?
‫My name is Hossein, and in this video I want to spin up a Postgres insistence and not only spin it
‫up and not only connect to it, but I want to establish a secure communication between my client and
‫my Postgres database by enabling TLC or SSL, the old name for it.
‫How about we jump into it, guys?
‫Because if you don't know what TLC has, check out this playlist.
‫What I discussed all the about this technology, transport layer security.
‫I show the handshake, I show.
‫Why do you want to encrypt the communication between client and server?
‫We talk about GPS and all that stuff, but database is no different.
‫For the longest time we have been connecting from a client to databases without encryption.
‫And our our excuse was that nobody actually sniffing between my database and my client, which is usually
‫the Web server.
‫Right.
‫Or a desktop application because usually the client is very close to the database.
‫And we talked about that.
‫Why write check out this video if you're interested, keep your servers close and your enemies closer
‫latency around trips, all that stuff.
‫We want to keep the database closest to the server or the client that makes the request.
‫However, in a cloud architecture, this is no longer a choice.
‫In a Bernardes Kloster, this is no longer a choice because these are kind of public, if you think
‫about it, that so we need to encrypt that stuff.
‫So how about we do that?
‫I'm going to I have DOCA installed.
‫Guys, if you only thing you have to do is just install for Mac and then install it for four windows
‫and one when you have that, just do not run.
‫Hello Dashboard.
‫And if you get that, that means you ready to rock and roll.
‫So I'm going to go ahead and spin up at a Posterous instance and it's very simple.
‫You do DOCA run and that's the name.
‫Let's give it a name called PJI.
‫And at Port I'm going to expose the default port five, four, three, two.
‫And finally, did you give it a name?
‫Yes, I give it a name.
‫And that's a goal because this will pull the latest version of Postgres.
‫Right.
‫And I think it's well worth.
‫And that's it.
‫Now we have Postgres, an extensive version of Pretty Coolish, but I need to consume postcrisis and
‫kind of connect to it.
‫Right.
‫So we need an admin and there is a beautiful and there is a beautiful tool that is actually another
‫container called Pejman.
‫So we're going to spin up a Bjurman instance right here and basically connect to our Postgres insistence
‫that we just exposed right there.
‫So in order to run that PJI admin, we're going to use that David Page Docker image, which is which
‫is as follows.
‫I'm going to do a docker run dash.
‫You're going to give it an environment, a variable PJI admin default email.
‫We done this before, guys, and just give it and I'm going to give it.
‫Hosain doesn't have to be email if you think about it.
‫Right.
‫Just do that.
‫Dashi PJI admin default password has to have a password.
‫Right.
‫And then give it password.
‫Very secure.
‫Right.
‫And then expose it to Port five five five five on port eighty.
‫I could have exposed to eighty but I like Phi Phi Phi Phi because I just used I'm used to having PJI
‫admin run on Phi Phi Phi Phi and then finally the name PJI admin and then finally the page SPG admin
‫for.
‫Thank you so much.
‫David Page is a real name.
‫Hopefully your first name is David Page, but also awesome.
‫So go ahead and run that stuff and looks like it's already so.
‫So now let's go to Chrome and connect to my page admin, which then I'm going to use to connect to my
‫posterous and manage my database.
‫How about we do that.
‫So localhost Phi Phi Phi Phi.
‫And.
‫Just like that, this is what we're going to get, what's the past where we put Hussein password connect?
‫Beautiful, very awesome.
‫So we have the pajama now, so we need to connect to the database.
‫Now, this is an unencrypted connection so that the defaulter says, hey, I prefer SSL, but we know
‫our database does not support SSL or secure socket layer.
‫Right.
‫So we're going to connect to it unencrypted by default.
‫So we're going to call it on secure PJI.
‫And the connection is what's the host, what's the hostname?
‫Hosain.
‫Mac what.
‫Port five, four, three, two.
‫Right.
‫What's the username?
‫Postgres and the default is also called Postgres.
‫And just like that, we have connected to the Daraba and guys, if now if I disconnected the server
‫and I went to properties and I forced.
‫Requiring SSL and I try to connect.
‫You will notice that I'm going to get an error, says, hey, the server does not support SSL, but
‫SSL was required in the connection.
‫So how do I enable SSL on my server?
‫How about we jump into it?
‫Guys, let's go ahead and go to back to my terminal, open a brand new tab and we're going to bash into
‫the PJI container.
‫Right.
‫So Docker exec dash it interactive terminal.
‫I want to bash into the PJI.
‫That's what we called our Postgres container.
‫I want to bash into it and I'm going to install Apte, get updates about get and install them, because
‫I'm going to edit some config here.
‫So let's wait for this to install to update all that stuff and install them.
‫Yes, please.
‫All right.
‫We have installed it.
‫So we go to VAR Leib, Postgres and data.
‫There is a config called postcrisis dot com.
‫We will go to that, put the configuration file here and I'm going to search for SSL option here and
‫I am going to turn this on.
‫But in order to turn it on, we need at minimum, we need two things.
‫We need the certificate force, which we talked about.
‫Check out the certificate file here to search the certificate video here.
‫And I'm going to call this service DOT PSM and the key file here, which is that the private key, which
‫is the the private key that will unlock that the certificate.
‫Right.
‫So I'm going to call it private UPM.
‫Right.
‫And here are some examples.
‫For example, what cyphers do you want to support.
‫Right.
‫How secure are your cyphers?
‫You can do all of these stuff.
‫Right.
‫Prefer cyphers.
‫And you want to support like the IRS version of what tearless version you want supported as Fergin one,
‫two or three.
‫Obviously one point three is is the best.
‫Right.
‫But we don't really care about this stuff now.
‫We can if we want to enable all that stuff.
‫So let's go ahead and save.
‫So we call this certain pen, the certificate and the private keys, private depen.
‫So we're going to write this file now.
‫But how where I should get these two files from?
‫Well, this is where openness will come in handy, right.
‫So I'm going to generate the certificate and as a self signed certificate just for testing.
‫Right.
‫And we have generated a certificate before from Let's Encrypt and that has like a proper certificate
‫authority and all that jazz.
‫Check out these videos, guys, if you are interested to learn more about that stuff.
‫So I'm going to do open SSL request and I need five or nine certificate, not six or five, four nine.
‫I want to do a new key that is of type A four thousand and zero nine six keys.
‫You need this or above to have a decent security.
‫2048 is good, but it's not good enough anymore.
‫These days can be broken very easily at nil d.
‫E.
‫S this.
‫I used to read this as node's.
‫No, it's actually no d which is the digital encryption standard which nobody use anymore.
‫Right.
‫So it means essentially don't encrypt the file because we will let both Chris read it.
‫And if we can't, we cannot let Posterous read that file if it's password protected.
‫Right.
‫I mean, the engine now supports a password file reading protected, but Bosco's, I believe, doesn't.
‫So we have to do that.
‫Yeah.
‫And then we do the key out.
‫I want the key to be here private the B.M. That's the key that the private key.
‫And we talked about private versus public.
‫You guys check out the encryption videos to learn more about this stuff.
‫And then finally out, which is the cert cert, CRT, Dopy.
‫And then just like that, if you enter, start generating the four thousand ninety six.
‫I'm going to ask some questions.
‫What's your country name?
‫This is for the certificate.
‫Right.
‫Country is the U.S. and state is California.
‫City is the McCulloh.
‫That's where I live organization name.
‫I don't know.
‫Hussein Nasr Hussein sir.
‫The server man.
‫That's the most important thing and I don't really care.
‫So I'm going to go ahead localhost.
‫Right.
‫And finally, the email
‫and that's it.
‫Now we have the certificate and the private keys.
‫If I do, who else?
‫We have the thirty PM and the private the PM.
‫And however, guys, the private OBM is secure by default and nobody can actually execute commands against
‫it.
‫So we need to do a search and change.
‫The mode on this to be 600, so that we allow execution on this file and just for the sake of it, we
‫also are going to change the owner to Postgres, which is the user running this thing.
‫So private UPM And just like that, you need to execute these two commands.
‫Obviously, guys, the all the commands of this thing is available in the description below.
‫And finally, we're going to exit or we have to do the docker stop BGI, Docker's start PJI and let's
‫go to my connection auriga.
‫So now that we have actually enabled SSL, let's go through my connection and make this actually required.
‫Remember, we used to get an error, but now I actually can connect.
‫And that's that's how basically you enable SSL, right, and now that doesn't mean that you cannot connect
‫through unsecure connections, right.
‫So you can still go here and disable the connection here.
‫Right.
‫And in the client says, hey, I don't want to actually connect with the server.
‫So I don't want to communicate in an encryption.
‫So you can still communicate unencrypted to the server.
‫But that to do that, you can either force client server, client side certificate to to avoid that
‫or just use the SBA to enable certain clients to connect to that.
‫That doesn't really matter, to be honest, because you're going to use anyway, the PGA option should
‫be a to only enable certain clients to connect to your Puskás database.
‫All right.
‫Quick video to show you this concept.
‫Let me know what you think I'm going to see in the next one.
‫You guys say awesome.
‫Goodbye.