AWS RDS Postgresql Pgadmin - Server doesn't listen - postgresql

I followed the aws tutorial found here.
Everything went smoothly up until connecting to the postgresql instance via pgadmin.
I entered the appropriate user/pw info and copy/pasted the address of the db appropriately.
The port is indeed 5432 on my aws dashboard.
I am receiving the following error message:
Server doesn't listen
The server doesn't accept connections: the connection library reports
could not connect to server: Operation timed out Is the server running on host "my_database_name.some_stuff.us-west-2.rds.amazonaws.com" (52.10.228.18) and accepting TCP/IP connections on port 5432?
If you encounter this message, please check if the server you're trying to contact is actually running PostgreSQL on the given port. Test if you have network connectivity from your client to the server host using ping or equivalent tools. Is your network / VPN / SSH tunnel / firewall configured correctly?
For security reasons, PostgreSQL does not listen on all available IP addresses on the server machine initially. In order to access the server over the network, you need to enable listening on the address first.
For PostgreSQL servers starting with version 8.0, this is controlled using the "listen_addresses" parameter in the postgresql.conf file. Here, you can enter a list of IP addresses the server should listen on, or simply use '*' to listen on all available IP addresses. For earlier servers (Version 7.3 or 7.4), you'll need to set the "tcpip_socket" parameter to 'true'.
You can use the postgresql.conf editor that is built into pgAdmin III to edit the postgresql.conf configuration file. After changing this file, you need to restart the server process to make the setting effective.
If you double-checked your configuration but still get this error message, it's still unlikely that you encounter a fatal PostgreSQL misbehaviour. You probably have some low level network connectivity problems (e.g. firewall configuration). Please check this thoroughly before reporting a bug to the PostgreSQL community.

Step 1
You are getting the same dialog I was seeing above. Crap!
Step 2
Go to your RDS instances
Step 3
Go to your security groups
Step 4
If your account was like mine you see this text:
Your account does not support the EC2-Classic Platform in this region.
DB Security Groups are only needed when the EC2-Classic Platform is supported.
Instead, use VPC Security Groups to control access to your DB Instances.
Go to the EC2 Console to view and manage your VPC Security Groups.
For more information, see AWS Documentation on Supported Platforms and Using RDS in VPC.
Step 5 Go back and check your RDS security group name (RDS->instances right click your instance). You will see something like Security GroupsList of VPC Security Groups associated with this DB Instance.
You will see something like:
default (sg-********) ( active )
Step 6 In your VPC security groups find your sg-******** that matches your database. Right click that. Edit inbound/outbound rules to add postgresql.
Try to connect again.
This solved my problem.
If this does not solve your problem I am very sorry, but I hope this documentation brings me some debugging karma.

go to AWS services in security group click on the security group id . from the "actions" button click on "edit inbound roles" and then change the "source" to "my ip"

Related

Timeout expired: Connecting Azure Postgres using local pdAmin

I am using psql on Azure. While I am successfully able to connect it on CLI and using Python psycopg2 or other modules and library, I am facing issue connecting it to the pgadmin Web UI.
The process to connect to the Azure POSTGRES in pgadmin is as follows:
Click on Add New Server.
Provide Name under General tab.
Provide Host, Port, DB Name, Username, Password.
After clicking on Save, it always pops connection timeout error.
While with the above config I can connect to it in the python, create cursor and commit a query. Do we require additional settings to be done for connecting it to the pgadmin. I am new to cloud and not sure if there is some additional security checks like token access to be provided or something.
Please have a check that have you enabled your local public IP address in Postgres DB Firewall rules?
After I created the new DB and added my local public IP to Firewall rules, I can connect to DB by local pgAdmin successfully:
Configs:
Allow your IP address in Azure postgresDB Networking section. You can configure your VNET or firewall rules as needed.
Check if your organization allows your IP to be visible to Azure. In my case, I was able to connect only when I was not connected to organization VPN.
"Some network environments may not report the actual public-facing IP address needed to access your server. Contact your network administrator if adding your IP address does not allow access to your server."
Under settings. Click on Networking. you will find a link like '+ Add current client IP address ( 119.160.103.152 ) + Add 0.0.0.0 - 255.255.255.255' click on it and use 0.0.0.0 to allow all public ip addresses. Now try to connect.
enter image description here
Above answer is correct but look at he above link now option for public ip is under Network option.
Connected success fully after doing this.

Does the fact I'm running a VM alter the whitelisting status of my regular ip address?

Our dev ops team have whitelisted my home ip address so that I can connect to our Postgres database on Azure. I am able to connect to our Azure database due to this.
Today I set up a VM in order to run Docker. I am running a container for RStudio which is an app that, among many other things, allows me to connect to our database using ODBC.
After configuring the odbcinst and odbc.ini files I believe that those are configured correctly because when I try to connect I get the following error:
Error: nanodbc/nanodbc.cpp:983: 00000: FATAL: SSL connection is required. Please specify SSL options and retry.
Thus I think that my odbc set up is correct because this error suggests my connection setting are fine, it's just that Azure will not allow it without SSL.
Searching that error message took me to this SO post with the following accepted answer:
By default, Azure Database for PostgreSQL enforces SSL connections between your server and your client applications to protect against MITM (man in the middle) attacks. This is done to make the connection to your server as secure as possible.
Although not recommended, you have the option to disable requiring SSL for connecting to your server if your client application does not support SSL connectivity. Please check How to Configure SSL Connectivity for your Postgres server in Azure for more details. You can disable requiring SSL connections from either the portal or using CLI. Note that Azure does not recommend disabling requiring SSL connections when connecting to your server.
My question is, if I am already able to connect to our database outside of my VM due to my home IP being whitelisted and just using a Postgres Driver with Dbeaver SQL client, is there anything I can do to connect from within my VM?
I can get my VMs ip address but I suspect (am not sure) if sending hat to our developers to whitelist would work?
Is there a prescribed course of action here?
I added this parameter to my .odbc.ini file and was able to connect:
sslmode=require
From Azure Postgres documentation, this parameter may take on different permutations depending on the context
"for example "ssl=true" or "sslmode=require" or "sslmode=required" and other variations"

connect to amazon RDS on scaleway server

I wanna try amazon RDS for my project, so I created micro instance in amazon AWS. I am new to AWS, I added my server IP to security group and VPC. I tried to connect from server:
psql -h digrin.asdada.us-west-2.rds.amazonaws.com -p 5432 -d digrin -U my_username -W
psql: could not connect to server: Connection timed out
Is the server running on host "digrin.asdada.us-west-2.rds.amazonaws.com" (54.71.212.12) and accepting
TCP/IP connections on port 5432?
I can login from localhost, so I was going through amazon AWS settings multiple times and added IP of server everywhere I thought might be causing problems. No luck.
Then I tried to login from another server, which IP I did not add anywhere to AWS and I did connect successfully - so my database is pulicly available.
So I thought my server provider is blocking 5432 port or something such. I created ticket with them (Scaleway) and this is what I got:
Hello,
Please understand that we do not provide support regarding software management / Firewall configuration.
On our end, nothing is locked network-wise on any port unless you modify your security group's configuration.
I don't understand where the issue could be. Any ideas?
Network access to your RDS instances is controlled by a security group which acts somewhat like a firewall. Rules can be crafted in security groups to allow other members of that security group to connect to each other, which is the default policy in the default security group. Thus because your RDS instance and your EC2 instance are members of the same security group they can communicate freely but nothing else outside of that group can communicate with either host.
An instance can be a member of more than one security group at a time and if there are rules allowing the traffic in any of the security groups for which the instance is a member then the traffic will be allowed. In the spirit of security I would suggest not opening more ports than necessary and would not recommend opening ports within the default security group as that would effectively make those ports accessible on all instances in that security group.
So, to allow access to your Scaleway host:
Create a new security group from the VPC console, add a rule to this group that allows the MySQL port to be accessed from the IP address of your Scaleway host (or from anywhere, depending on your level of security concerns)
Attach that security group to your database in addition to the default security group through the RDS console

MongoDB - Prevent unauthorized user from opening console

Trying to set up authorization in my development cluster, I couldn't prevent users from opening a console to my mongods.
I have enabled authorization in the config file:
secutiry:
authorization: enabled
And have created an admin user with the userAdminAnyDatabase role.
Yet, when connecting unauthorized to this server from another machine, I can enter the console.
I do get permission error when trying to issue commands, but I would like to know if there's any way of preventing the console from opening - getting the permission error earlier.
If you only need to access your MongoDB deployment from applications running on the same server you can use the bind_ip configuration option to control the network interface(s) that MongoDB processes listen to. By default this should already be set to '127.0.0.1' (localhost) in packaged versions of MongoDB 2.6+.
If you want to have the server listening to a more public network interface (eg. local LAN) and want to prevent remote connections entirely, you can limit source IP access via your firewall configuration.
The Network Security Tutorials in the MongoDB manual include examples that should be useful as a starting point:
Configure Linux iptables Firewall for MongoDB
Configure Windows netsh Firewall for MongoDB
If users/applications might authenticate from those remote IPs, you can't prevent them from opening a console connection (with no permissions). This is similar to how other services (sshd, apache, etc) work with authentication: step 1 is to establish a connection and step 2 authenticates.
For more information on MongoDB best practices, please refer to the Security section in the manual.

Google Cloud SQL VM refusing connection

I have been stuck trying to figure out why my Cloud SQL VM is refusing my connection from my machine (whom ip address I have added as a subnet). I cann SSH into the VM but i cannot access the VM from a browser to make SQLs. I have scoured the internet for days trying to find a fix but i cannot seem to get pass this point. My apache listens to port 80. Also Id like to add that I have been connecting to my Mysql db for months through php and making sqls so I do not believe the problem is with apache. However if it is please point me to where i should be looking.
It sounds like you have MySQL running on a GCE VM, not an actual CloudSQL instance (that is a different service from GCE). Is that right?
If so, then if you are trying to connect from your local machine directly to the mysql instance, you are probably getting blocked by the firewall. Go to the networks tab (under Compute Engine) on the cloud console and see what firewall rules you have enabled. You might need to add one for 3306 or whatever port you are using.