Re: Why don't we allow DNS names in pg_hba.conf?

On Sun, Jan 01, 2006 at 09:03:00PM +0100, Andreas Pflug wrote:
> Marc G. Fournier wrote:
>
> >On Sun, 1 Jan 2006, Tom Lane wrote:
> >
> >>I was reminded of $subject by
> >>http://archives.postgresql.org/pgsql-admin/2006-01/msg00002.php
> >>
> >>While I haven't tried it, I suspect that allowing a DNS host name
> >>would take little work (basically removing the AI_NUMERICHOST flag
> >>passed to getaddrinfo in hba.c). There was once a good reason not
> >>to allow it: slow DNS lookups would lock up the postmaster. But
> >>now that we do this work in an already-forked backend, with an overall
> >>timeout that would catch any indefinite blockage, I don't see a good
> >>reason why we shouldn't let people use DNS names.
> >>
> >>Thoughts?
> >
> >
> >Security?
>
>
> I'd bet most pg_hba.conf entries will be (private) networks, not hosts.
> Since private networks defined in DNS are probably quite rare, only few
> people could benefit.
>
> Those who *do* define specific host entries, are probably quite security
> aware. They might find DNS safe for their purposes, but they'd probably
> like a function that shows the resulting hba entries after DNS resolution.

I don't know if the normal DNS libraries allow this, but it would be
cool if you could specify that an entry in pg_hba.conf could be looked
up from /etc/hosts, but not from generic DNS. AFAIK that would eliminate
the possibility of spoofing.
--
Jim C. Nasby, Sr. Engineering Consultant jnasby(at)pervasive(dot)com
Pervasive Software http://pervasive.com work: 512-231-6117
vcard: http://jim.nasby.net/pervasive.vcf cell: 512-569-9461