{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/950","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/950/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/950/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/950/events","html_url":"https://github.com/hashicorp/vault/issues/950","id":127996488,"number":950,"title":"Postgres secret backend locks up after a certain amount of time","user":{"login":"hobbeswalsh","id":14958,"avatar_url":"https://avatars.githubusercontent.com/u/14958?v=3","gravatar_id":"","url":"https://api.github.com/users/hobbeswalsh","html_url":"https://github.com/hobbeswalsh","followers_url":"https://api.github.com/users/hobbeswalsh/followers","following_url":"https://api.github.com/users/hobbeswalsh/following{/other_user}","gists_url":"https://api.github.com/users/hobbeswalsh/gists{/gist_id}","starred_url":"https://api.github.com/users/hobbeswalsh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hobbeswalsh/subscriptions","organizations_url":"https://api.github.com/users/hobbeswalsh/orgs","repos_url":"https://api.github.com/users/hobbeswalsh/repos","events_url":"https://api.github.com/users/hobbeswalsh/events{/privacy}","received_events_url":"https://api.github.com/users/hobbeswalsh/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/hashicorp/vault/milestones/5","html_url":"https://github.com/hashicorp/vault/milestones/0.5.0","labels_url":"https://api.github.com/repos/hashicorp/vault/milestones/5/labels","id":1381611,"number":5,"title":"0.5.0","description":null,"creator":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":16,"state":"open","created_at":"2015-10-28T15:09:50Z","updated_at":"2016-01-25T19:47:29Z","due_on":null,"closed_at":null},"comments":15,"created_at":"2016-01-21T19:04:13Z","updated_at":"2016-01-25T19:47:28Z","closed_at":"2016-01-25T19:47:28Z","body":"Hi there,\r\n\r\nI'm using the Postgres secret backend to dynamically generate secrets for one of our production databases. Immediately after I mount the secret backend and configure it, a `vault read` succeeds without a problem, and I can see my newly-created user in the Postgres database:\r\n\r\n```\r\npostgres=# \\du\r\n                                                  List of roles\r\n                       Role name                       |                 Attributes                  | Member of \r\n-------------------------------------------------------+---------------------------------------------+-----------\r\n daemon                                                |                                             | {}\r\n admin                                                 | Create DB                                   | {}\r\n ldap-hobbeswalsh-f7318add-1ae7-d7e1-9653-24242d4e0c30 | Password valid until 2016-01-21 06:50:56+00 | {}\r\n postgres                                              | Superuser, Create role, Create DB           | {}\r\n readonly                                              |                                             | {}\r\n```\r\n\r\nHowever, when I walk away from the console and then try to get a password later, the Vault server freezes up.\r\n\r\n```\r\n➤ vault read postgresql/creds/readonly\r\nError reading postgresql/creds/readonly: Error making API request.\r\n\r\nURL: GET https://vault.mydomain.com/v1/postgresql/creds/readonly\r\nCode: 504. Raw Message:\r\n\r\n```\r\n\r\nI see that the Vault server has active connections to our database server:\r\n\r\n```\r\nvault$ netstat -tn | grep '<DB_IP>'\r\ntcp        0      0 10.128.1.36:41389       <DB_IP>:5432      ESTABLISHED\r\ntcp        0      0 10.128.1.36:40861       <DB_IP>:5432      ESTABLISHED\r\ntcp        0      0 10.128.1.36:41429       <DB_IP>:5432      ESTABLISHED\r\ntcp        0      0 10.128.1.36:41388       <DB_IP>:5432      ESTABLISHED\r\n```\r\n\r\nBut a `tcpdump` does not show any activity to that IP address when I perform a `vault read` for some credentials.\r\n\r\nThe Vault server is a standard EC2 instance in a VPC. The database server is in our data center, so there are several routers (and firewalls!) that a connection from Vault to the database would have to traverse. I suppose my three questions are:\r\n\r\n * What can I do to further troubleshoot this?\r\n * Why does Vault think the best policy is to just keep a connection open to the database forever (I could be misunderstanding, but I think that's what [this stanza](https://github.com/hashicorp/vault/blob/master/builtin/logical/postgresql/backend.go#L59-L61) is about)?\r\n * What's the deal with `netstat` showing this connection as `ESTABLISHED`? Shouldn't I see Vault send out some TCP chatter when I request a secret?\r\n\r\nThanks a lot."}}