On Dec 27, 2006, at 1:47 PM, Joshua D. Drake wrote:
On Wed, 2006-12-27 at 16:41 -0500, Stephen Frost wrote:
* Joshua D. Drake ([EMAIL PROTECTED]) wrote:
Allow pg_hba.conf to specify host names along with IP addresses
Excellent.
Host name lookup could occur when the postmaster reads the
pg_hba.conf
file, or when the backend starts. Another solution would be to
reverse
lookup the connection IP and check that hostname against the host
names
in pg_hba.conf. We could also then check that the host name maps
to the
IP address.
Doing the DNS at connect time, not startup time is the right thing to
do. The
main reason to use hostnames rather than IP addresses (or domain
wildcards
vs CIDR blocks) is because you're expecting the mapping to change. You
really don't want to add "restart all our postgresql instances" to
the DNS managers
"I changed a hostname" checklist.
I'm inclined towards doing the reverse-DNS of the connecting IP
and then
checking that the forward of that matches.
Hmm what if it doesn't? Which is the case any many scenario. My
thoughts
are:
If www.commandprompt.com is allowed, then the ip address
207.173.200.129
is allowed to connect.
DNS is cheap. For the simple case it wouldn't be too hard to expand
all the given
hostnames at connect time, but there's a problem ...
If we go the reverse way:
129.200.173.207.in-addr.arpa name = 129.commandprompt.com.
Which really isn't that useful imo.
... unfortunately, you need to do it that way if you want to support
wildcards, as there's no way to expand *.example.com to a list of
IP addresses.
Allow one to specify a FQDN or a simple wild card DN. E.g;
*.commandprompt.com.
A valid entry would look like this:
host all all *.commandprompt.com trust
host all all www1.postgresql.org md5
Thoughts?
While a wildcard does make sense (ie: www*.postgresql.org), I would
generally expect 'commandprompt.com' to mean '*.commandprompt.com'
implicitly.
Hmm interesting. I wouldn't expect that. I might
expect .commandprompt.com to mean *.commandprompt.com. But
commandprompt.com I would expect only whatever the A record returns as
commandprompt.com.
One thing I don't want to do is create a bunch of different style
syntaxes that are available :)
tcp_wrappers (/etc/hosts.allow and friends) are one fairly widely
used standard for this, and one that's mostly compatible with the
existing usage for dotted quads, I think. It uses ".example.com"
to match anything that ends in "example.com".
(If you're going down that road you can also have a "host" that
begins with a "/" to refer to an external list of filenames, but that
way may lie madness.)
Cheers,
Steve
---------------------------(end of broadcast)---------------------------
TIP 3: Have you checked our extensive FAQ?
http://www.postgresql.org/docs/faq
