forked from server/user-documentation
Merge branch 'pgsql-upd'
Merged pgsql update
This commit is contained in:
Peter Boy
commit
30f4ec2a2d
4 changed files with 154 additions and 98 deletions
|
|
@ -24,6 +24,7 @@
|
|||
|
||||
* Providing services
|
||||
** xref:services/postgresql-setup.adoc[Setting up PostgreSQL Database Server]
|
||||
** xref:services/fedsysadmins-cheatsheet-postgresql.adoc[Fedora Server System Administrator's Cheat Sheet: PostgreSQL]
|
||||
** xref:services/httpd-basic-setup.adoc[Setting up a basic web server]
|
||||
** xref:services/filesharing-nfs-installation.adoc[File sharing with NFS – Installation]
|
||||
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ Detailed step-by-step instructions are given for various typical areas of applic
|
|||
|
||||
- People, policies, and working methods
|
||||
|
||||
|
||||
[updating-f43]
|
||||
=== Updating to Fedora 43
|
||||
|
||||
The recommended procedure is upgrading using the _DNF System Upgrade_ plugin. This applies to Fedora Server Edition on hardware as well as in a virtual machine.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,59 @@
|
|||
= Fedora Server System Administrators Cheat Sheet: PostgreSQL
|
||||
Peter Boy
|
||||
:page-authors: {author}
|
||||
:revnumber: F35-F43
|
||||
:revdate: 2025-12-04
|
||||
|
||||
[abstract]
|
||||
The Fedora System Administrator's Cheat Sheet series compiles typical, frequently used instructions for various application programs, most of which can be used with minor modifications via copy&paste. They also contain direct links to the relevant sections of the upstream documentation.
|
||||
|
||||
==== Basic Commands
|
||||
|
||||
Get administrative access to a postgresql database and get a postgres terminal prompt::
|
||||
+
|
||||
----
|
||||
[...]# sudo -i -u postgres psql
|
||||
psql (18.1)
|
||||
Type "help" for help.
|
||||
|
||||
postgres=#
|
||||
----
|
||||
|
||||
List all databases::
|
||||
+
|
||||
----
|
||||
postgres=# \l
|
||||
----
|
||||
|
||||
Connect to a database::
|
||||
+
|
||||
----
|
||||
postgres=# \c <database_name_from_above_list>
|
||||
----
|
||||
|
||||
List all tables in the database connected to::
|
||||
+
|
||||
----
|
||||
postgres=# \dt
|
||||
----
|
||||
|
||||
List all users / roles::
|
||||
+
|
||||
----
|
||||
postgres=# \du
|
||||
----
|
||||
|
||||
|
||||
Create a new user / role::
|
||||
+
|
||||
----
|
||||
postgres=# CREATE USER new_user_name WITH PASSWORD 'password';
|
||||
----
|
||||
|
||||
|
||||
|
||||
Change password of a user / role::
|
||||
+
|
||||
----
|
||||
postgres=# ALTER USER user_name WITH PASSWORD 'new_password';
|
||||
----
|
||||
|
|
@ -1,30 +1,17 @@
|
|||
= Setting up PostgreSQL Database Server
|
||||
Peter Boy
|
||||
:page-authors: {author}
|
||||
:revnumber: F35-F37
|
||||
:revdate: 2022-11-15
|
||||
:revnumber: F35-F43
|
||||
:revdate: 2026-01-23
|
||||
// :revremark: a new beginning
|
||||
:page-aliases: service-postgresql-installation.adoc
|
||||
:page-aliases: services/postgresql-installation.adoc
|
||||
|
||||
[abstract]
|
||||
____
|
||||
Postgresql is the recommended database management system of Fedora. It is a key functionality that is part of the Release criteria.
|
||||
____
|
||||
|
||||
|
||||
// Before publishing on main site, comment out
|
||||
// the warning. Comment in again when start to update.
|
||||
//[WARNING]
|
||||
//====
|
||||
//**You are in the Fedora Server documentation staging area!**
|
||||
//
|
||||
//These documents are not approved yet and may be incomplete and/or incorrect. You would probably prefer to study the https://docs.stg.fedoraproject.org/en-US/fedora-server/[published documentation].
|
||||
|
||||
// *Status of this document*: Updated to f41.
|
||||
//====
|
||||
|
||||
Fedora 40 and 41 both include PostgreSQL 16.3. So there is no need to update the database when updating to Release 41.
|
||||
Fedora 43 includes PostgreSQL 18.1 If you update from F42, read the release notes or the xref:index.adoc#_updating_to_fedora_43[update description on Server home page] for detailed instructions.
|
||||
|
||||
== 1. Storage preparation
|
||||
|
||||
|
|
@ -32,19 +19,24 @@ In Fedora, PostgreSQL stores the databases and other runtime files in the `/var/
|
|||
|
||||
Following the Fedora storage concept, a dedicated file system on a logical volume, mounted at the appropriate position in the directory tree, takes over this function.
|
||||
|
||||
A convenient descriptive name for both the logical volume and the file system is `pgsql`. The volume group that contains the logical volume is called `fedora_fedora` in a default installation. A suitable initial size is likely to be 50 GiB in many cases.
|
||||
A convenient descriptive name for both the logical volume and the file system is `pgsql`. The volume group that contains the logical volume is called `fedora` or `systemVG` in a default installation. A suitable initial size is likely to be 50 GiB in many cases.
|
||||
|
||||
In any case, the system administrator must adapt the following command sequence according to the local requirements! With a Linux LVM and Software raid, XFS can autonomously determine its optimal configuration values. With some hardware raids, intervention by the administrator can also be useful for this.
|
||||
|
||||
First, check for the VG name and then adjust the following commands.
|
||||
[source,]
|
||||
----
|
||||
[…]# vgs
|
||||
[…]# lvcreate -L 50G -n pgsql fedora_fedora
|
||||
[…]# mkfs.xfs -L pgsql /dev/mapper/fedora_fedora-pgsql
|
||||
VG #PV #LV #SN Attr VSize VFree
|
||||
systemVG 1 1 0 wz--n- 7.55g <4.42g
|
||||
[…]# lvcreate -L 50G -n pgsql systemVG
|
||||
Logical volume "pgsql" created.
|
||||
[…]# mkfs.xfs -L pgsql /dev/mapper/systemVG-pgsql
|
||||
meta-data=/dev/mapper/systemVG-pgsql isize=512 agcount=4, agsize=655360 blks
|
||||
...
|
||||
Discarding blocks...Done.
|
||||
[…]# mkdir /var/lib/pgsql
|
||||
[…]# vim /etc/fstab
|
||||
(insert)
|
||||
/dev/mapper/fedora_fedora-pgsql /var/lib/pgsql auto defaults 0 0
|
||||
(save & quit)
|
||||
[…]# echo "UUID=$(blkid -s UUID -o value /dev/systemVG/pgsql) /var/lib/pgsql auto defaults 0 0" >> /etc/fstab
|
||||
[…]# mount -a
|
||||
[…]# df -h
|
||||
----
|
||||
|
|
@ -58,17 +50,17 @@ The package provides the pure server functionality. Fedora additionally loads th
|
|||
----
|
||||
[…]# dnf install postgresql-server
|
||||
...
|
||||
==============================================================================================
|
||||
Package Architectur Version Repository Size
|
||||
==============================================================================================
|
||||
==============================================================================
|
||||
Package Architectur Version
|
||||
==============================================================================
|
||||
Installing:
|
||||
postgresql-server x86_64 14.3-2.fc37 updates 5.9 M
|
||||
postgresql-server x86_64 18.0-1.fc43
|
||||
Installing dependencies
|
||||
postgresql x86_64 14.3-2.fc37 updates 1.6 M
|
||||
postgresql-private-libs x86_64 14.3-2.fc37 updates 138 k
|
||||
postgresql x86_64 18.0-1.fc43
|
||||
postgresql-private-libs x86_64 18.0-1.fc43
|
||||
|
||||
Transaction Summary
|
||||
==============================================================================================
|
||||
==============================================================================
|
||||
Install 3 packages
|
||||
----
|
||||
|
||||
|
|
@ -82,15 +74,14 @@ The installer should have adjusted all SELinux labels in the pgsql directory alr
|
|||
-rw-r--r--. 1 postgres postgres system_u:object_r:postgresql_db_t:s0 ... .bash_profile
|
||||
drwx------. 2 postgres postgres system_u:object_r:postgresql_db_t:s0 ... data
|
||||
----
|
||||
|
||||
If the installation program missed something, fix it executing
|
||||
If the installation program missed something, fix it executing
|
||||
[source,]
|
||||
----
|
||||
[…]# restorecon -vFr /var/lib/pgsql
|
||||
[…]# ls -alZ /var/lib/pgsql/
|
||||
----
|
||||
|
||||
It is also a prerequisite that exclusively the user postgres has access to the directory pgsql and its subdirectories. Usually the installer takes care of it. Fix it if necessary.
|
||||
It is also a prerequisite that exclusively the user postgres has access to the directory pgsql and its subdirectories. Usually the installer takes care of it. Fix it if necessary.
|
||||
[source,]
|
||||
----
|
||||
[…]# chown -R postgres:postgres /var/lib/pgsql
|
||||
|
|
@ -107,36 +98,87 @@ When all the requirements are met, perform the initialization of the database cl
|
|||
|
||||
Fedora preconfigures Postgresql in a way that in any case ensures reliable and maintainable operation on the one hand and secure operation as far as possible on the other.
|
||||
|
||||
=== Database connection paths
|
||||
|
||||
A client can connect to the server either by a Unix socket connection or a TCP/IP connection.
|
||||
|
||||
If the client does not specify a hostname parameter (-h), a Unix socket connection is established. Postgres uses this method to ensure that root can always securely establish a connection, regardless of password loss, for example. The root user always has permission to assume the identity of the postgresql master user (su - postgres). By default, no other user has this option. As root, you get in any circumstances administrative access to the database.
|
||||
[source]
|
||||
----
|
||||
[…]# su - postgres
|
||||
[…]$ psql
|
||||
----
|
||||
|
||||
Specifying the host parameter results in an attempt to establish a TCP/IP connection. Postgresql uses port 5432 by default for this purpose. In Fedora, all interfaces are protected by a firewall by default, except for localhost. A connection therefore requires opening a suitable port.
|
||||
|
||||
Fedora abstracts the technical details with Firewalld, so that the administrator does not need to bother with details. For most common uses there are predefined services. So, if you want the database to be accessible via the internal interface assigned to the internal zone, for example, you need just two simple instructions.
|
||||
[source]
|
||||
----
|
||||
[…]$ sudo firewall-cmd --zone=internal --permanent --add-service=postgresql
|
||||
[…]$ sudo firewall-cmd --reload
|
||||
----
|
||||
|
||||
[TIP]
|
||||
====
|
||||
In case of connection issues there is most probably a SELinux configuration missing, in most case a "__name_connect access on the tcp_socket__" issue. Check the SELinux module in Cockpit. It helps you in detail to establish a local policy to fix it. It is easy, just a matter of 2 instructions.
|
||||
====
|
||||
|
||||
=== Authentification options
|
||||
|
||||
==== Administrative access
|
||||
|
||||
For admin access Fedora postgresql is configured to obtain the host's operating system user name from the kernel and using it as the allowed database user name. Therefore, as soon as someone can authentiate on the host as user __postgres__, that person has administrative privileges on the postgresql server without any additional password prompt. The only one who can do that by default, is root. Root can configure additional users to be able to su to postgres. In any case, in a whatever emergency, if any then the system administrator is able to quickly access postgresql server unhindered and salvage what can still get salvaged.
|
||||
|
||||
This capability is configured in the ~/data/pg_hba file, together with other properties.
|
||||
[source,]
|
||||
----
|
||||
[…]# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
...
|
||||
# PostgreSQL Client Authentication Configuration File
|
||||
# ===================================================
|
||||
...
|
||||
|
||||
# TYPE DATABASE USER ADDRESS METHOD
|
||||
# "local" is for Unix domain socket connections only
|
||||
local all all peer
|
||||
----
|
||||
It is really not a good idea to change the entry in the line ‘local all ...’ in any way. Whatever you configure later in this file, do not change this line, or only do so if you are absolutely sure of what you are doing.
|
||||
|
||||
If local regulations make it necessary to replace these procedures with a dedicated authentication by postgresql itself, one of the other procedures can be configured later. In general, however, it is not advisable to make any changes. Once root is compromised, there are a lot of completely different problems to get tackled.
|
||||
|
||||
==== Client user access
|
||||
|
||||
In the initial configuration postgresql restricts any authentication to peer as above described or ident (i.e. asking a ident server). In most cases you need an authentication based on a kind of password, mostly still md5 despite its security issues. The details depend on the prospective clients. As a typical use case we will accept connections from the internal network to VMs, by default 192.169.122.0/24.
|
||||
In the initial configuration postgresql restricts any authentication to peer as above described or ident (i.e. asking an ident server, that Fedora doesn't install). In most cases you need an authentication based on a password. The details depend on the prospective clients. As a typical use case we will accept connections from the internal network to VMs, by default 192.169.122.0/24.
|
||||
|
||||
The configuration is done in the file `pg_hba.conf` in the `data` subdirectory. Edit the file to match the pattern below.
|
||||
[source,]
|
||||
----
|
||||
[…]# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
# TYPE DATABASE USER ADDRESS METHOD
|
||||
# "local" is for Unix domain socket connections only
|
||||
local all all peer
|
||||
# IPv4 local connections:
|
||||
host all all 127.0.0.1/32 ident
|
||||
# IPv4 internal network connections: # <- modification!
|
||||
host all all 192.168.122.1/24 md5 # <- modification!
|
||||
# IPv6 local connections:
|
||||
host all all ::1/128 ident
|
||||
[…]# vim /var/lib/pgsql/data/pg_hba.conf
|
||||
# PostgreSQL Client Authentication Configuration File
|
||||
# ===================================================
|
||||
...
|
||||
...
|
||||
|
||||
# TYPE DATABASE USER ADDRESS METHOD
|
||||
...
|
||||
...
|
||||
# IPv4 local connections:
|
||||
host all all 127.0.0.1/32 ident
|
||||
# IPv4 internal network connections: # <- modification!
|
||||
host all all 192.168.122.1/24 scram-sha-256 # <- modification!
|
||||
# IPv6 local connections:
|
||||
host all all ::1/128 ident
|
||||
# Allow replication connections from localhost, by a user with the
|
||||
----
|
||||
Add further entries according to the need, as far as they are already known. Additions are possible at any time later, but require a reload of the server, i.e. at least a short service interruption.
|
||||
|
||||
For further details see the PostgreSQL documentation, chapter https://www.postgresql.org/docs/13/auth-methods.html[20.3. Authentication Methods]
|
||||
To make access via the 192.168.122.1/24 host interface really work, you have to add the host's IP address on that network to postgresql.conf.
|
||||
|
||||
For further details see the PostgreSQL documentation, chapter https://www.postgresql.org/docs/current/auth-pg-hba-conf.html[20.1. The pg_hba.conf File].
|
||||
[TIP]
|
||||
====
|
||||
Some of the possible authentication methods require additional settings for SELinux. For example, the _PAM_ method requires unix_chkpwd access permissions. A typical error message is “__SELinux is preventing auth from name_connect access on the tcp_socket port 5432__”. The easiest way to fix this is to use the SELinux module from Cockpit..
|
||||
====
|
||||
|
||||
=== Connection options
|
||||
|
||||
|
|
@ -153,11 +195,11 @@ Connections granted are configured in ~/data/postgresql.conf. To grant access t
|
|||
|
||||
# - Connection Settings -
|
||||
|
||||
listen_addresses = 'localhost, 192.168.122.1/24'
|
||||
#listen_addresses = 'localhost' # what IP address(es) to listen on;
|
||||
# comma-separated list of addresses;
|
||||
# defaults to 'localhost'; use '*' for all
|
||||
# (change requires restart)
|
||||
listen_addresses = 'localhost, 192.168.122.1/24'
|
||||
#port = 5432 # (change requires restart)
|
||||
max_connections = 100 # (change requires restart)
|
||||
...
|
||||
|
|
@ -172,6 +214,8 @@ You are now ready to start the PostgreSQL server.
|
|||
----
|
||||
[…]# systemctl start postgresql
|
||||
[…]# systemctl status postgresql
|
||||
...
|
||||
... systemd[1]: Started postgresql.service - PostgreSQL database server.
|
||||
----
|
||||
|
||||
If no errors are reported, try to connect as user postgres using the psql cli client. Once connected, start commands with backslash, e.g. \? to get help or \q to quit.
|
||||
|
|
@ -179,7 +223,7 @@ If no errors are reported, try to connect as user postgres using the psql cli cl
|
|||
----
|
||||
[…]# su - postgres
|
||||
[…]$ psql
|
||||
psql (13.4)
|
||||
psql (18.0)
|
||||
Enter »help« ...
|
||||
|
||||
postgres=# \dg
|
||||
|
|
@ -189,7 +233,8 @@ If no errors are reported, try to connect as user postgres using the psql cli cl
|
|||
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
|
||||
|
||||
postgres-# \q
|
||||
[…]$
|
||||
[…]$ exit
|
||||
[…]#
|
||||
----
|
||||
|
||||
If everything works as expected, enable autostart of postgresql,
|
||||
|
|
@ -198,55 +243,6 @@ If everything works as expected, enable autostart of postgresql,
|
|||
[…]# systemctl enable postgresql
|
||||
----
|
||||
|
||||
== 4. A system administrator's quick PostgreSQL cheat sheet
|
||||
|
||||
Get access to a postgresql database and get a postgres terminal prompt::
|
||||
+
|
||||
----
|
||||
[...]# sudo -i -u postgres psql
|
||||
psql (16.3)
|
||||
Type "help" for help.
|
||||
|
||||
postgres=#
|
||||
----
|
||||
|
||||
List all databases::
|
||||
+
|
||||
----
|
||||
postgres=# \l
|
||||
----
|
||||
|
||||
Connect to a database::
|
||||
+
|
||||
----
|
||||
postgres=# \c <database_name_from_above_list>
|
||||
----
|
||||
|
||||
List all tables in the database connected to::
|
||||
+
|
||||
----
|
||||
postgres=# \dt
|
||||
----
|
||||
|
||||
List all users / roles::
|
||||
+
|
||||
----
|
||||
postgres=# \du
|
||||
----
|
||||
|
||||
|
||||
Create a new user / role::
|
||||
+
|
||||
----
|
||||
postgres=# CREATE USER new_user_name WITH PASSWORD 'password';
|
||||
----
|
||||
|
||||
|
||||
Change password of a user / role::
|
||||
+
|
||||
----
|
||||
postgres=# ALTER USER user_name WITH PASSWORD 'new_password';
|
||||
----
|
||||
|
||||
|
||||
Enjoy a powerful DBMS.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue