Re: Why don't we allow DNS names in pg_hba.conf?

From: Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: mark(at)mark(dot)mielke(dot)cc, Andrew Dunstan <andrew(at)dunslane(dot)net>, Euler Taveira de Oliveira <eulerto(at)yahoo(dot)com(dot)br>, "Jim C(dot) Nasby" <jnasby(at)pervasive(dot)com>, Andreas Pflug <pgadmin(at)pse-consulting(dot)de>, "Marc G(dot) Fournier" <scrappy(at)postgresql(dot)org>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: Why don't we allow DNS names in pg_hba.conf?
Date: 2006-02-13 03:42:31
Message-ID: 200602130342.k1D3gVu06834@candle.pha.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers


Added to TODO:

o Allow pg_hba.conf to specify host names along with IP addresses

Host name lookup could occur when the postmaster reads the
pg_hba.conf file, or when the backend starts. Another
solution would be to reverse lookup the connection IP and
check that hostname against the host names in pg_hba.conf.
We could also then check that the host name maps to the IP
address.

---------------------------------------------------------------------------

Tom Lane wrote:
> mark(at)mark(dot)mielke(dot)cc writes:
> > On Tue, Jan 03, 2006 at 12:43:03PM -0500, Tom Lane wrote:
> >> I'm not sure about the relative usefulness of this compared to the
> >> forward-lookup case, nor whether it's riskier or less risky from a
> >> spoofing point of view. But something to consider.
>
> > I think it's riskier. I have my own PTR records, that I can make be
> > whatever I wish without any authority verifying that my actions are
> > proper.
>
> Yeah, that occurred to me after a few moments' thought. We could do one
> extra forward lookup to confirm that the reverse-lookup name maps back
> to the IP address.
>
> > It's not a big deal.
>
> Depends on how many names you want to put into pg_hba.conf. I don't
> offhand see a use-case for very many, but maybe there is one. Even
> if there are a lot, they'd not be expensive to look up if there is
> a local nameserver that is authoritative for those names ... which
> I'd think would be the normal case. The more "outside" names you've
> got in pg_hba.conf, the more open you are to spoofing.
>
> regards, tom lane
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Have you searched our list archives?
>
> http://archives.postgresql.org
>

--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Bruce Momjian 2006-02-13 04:01:24 Re: psql & readline & win32
Previous Message Christopher Kings-Lynne 2006-02-13 01:59:38 Re: [HACKERS] slow information schema with thausand users,