This is about Metasploit Framework.

root@kali:~# service postgresql start
[....] Starting PostgreSQL 9.1 database server: main[....] The
PostgreSQL server failed to start. Please check the log output: 
2015-05-23 19:07:58 EDT LOG: database system was interrupted; 
last known up at 2015-05-23 16:52:00 EDT 2015-05-23 19:07:58 
EDT FATAL: could not open file "/etc/ssl/certs/ssl-cert-snakeoil.pem":   
Permission denied 2015-05-23 19:07:58 EDT LOG: startup process 
(PID 3466) exited with exit code 1 2015-05-23 19:07:58 EDT LOG: 
aborting startup due to startup [FAILss failure ... failed! failed!

My first question is, PostgreSQL was working perfectly. What things triggered this problem suddenly?

Secondly, how to fix this?

3 Answers 3


It's likely the result of the Postgres fsync Permissions Bug.

The referenced Wiki page notes that the issue was due to be fixed in the 2015-06-04 Update Release, and that it affected users who:

  1. applied the 9.4.2, 9.3.7, 9.2.11, 9.1.16 and/or 9.0.20 PostgreSQL updates
  2. have one or more files or directories, or symlinks to one or more files or directories, not owned or writeable by the postgres user (or other installation owner) under the postgres data directory (PGDATA).

It goes on to say that condition 2 is common to SSL-enabled Debian and Ubuntu installations of PostgreSQL 9.1, 9.0, and earlier, but may affect other users as well. Most users on other platforms are not affected, as all files and links under PGDATA are owned by the postgres user by default.


In the text you have quoted is the reason:

FATAL: could not open file "/etc/ssl/certs/ssl-cert-snakeoil.pem":
Permission denied

If you really want to use the snakeoil certificate you need to ensure that PostgreSQL can read it. But it would be better to generate your own certificate and use that instead. (There's a reason why these certificates are called snakeoil.)

  • This is about Metasploit Framework.
    – user109285
    May 24, 2015 at 0:15
  • @BROY if that's relevant it would help to state it up front - like you have now done. Although I'm not clear why it is relevant. I'll go reading. May 24, 2015 at 0:18
  • @BROY, nope sorry, I don't see the relevance, other than it seems the documentation for Metasploit doesn't care it's recommending a snakeoil certificate. May 24, 2015 at 0:25

The solution is to use an acl,and permit to postgres user(is called postgres,or psql,check your password file) to read the


if user is called psql do this

setfacl -m u:psql:r--     /etc/ssl/certs/ssl-cert-snakeoil.pem

of course check if acl is active

mount |grep -w / |grep acl

if not edit fstab(make copy before) and after defaults, put acl

then mount -o remount / and set actl with setfacl

  • Or chmod a+r /etc/ssl/certs/ssl-snakeoil.pem, which is considerably easier May 24, 2015 at 7:23
  • FWIW, even with this file world readable, I am getting UTC FATAL: could not open file "/etc/ssl/certs/ssl-cert-snakeoil.pem": Permission denied at the moment. Jul 20, 2015 at 12:01

You must log in to answer this question.