Skip site navigation (1) Skip section navigation (2)

Re: pg_hba.conf confusion

From: Reinhard Max <max(at)suse(dot)de>
To: "David M(dot) Kaplan" <dmkaplan(at)ucdavis(dot)edu>
Cc: pgsql-bugs(at)postgresql(dot)org
Subject: Re: pg_hba.conf confusion
Date: 2002-06-18 16:51:57
Message-ID: (view raw, whole thread or download thread mbox)
Lists: pgsql-bugs
On Tue, 18 Jun 2002 at 09:28, David M. Kaplan wrote:

> Thanks, that did fix that problem.  Now I have another one.  The line:
> host    all    password
> matches all ip addresses of the form 192.168.1.x.  If I change the mask
> to it no longer matches all addresses.

I wasn't talking about that entry. Your mask here was correct.

> Although this fixes the problem, it seems strange to me that it
> works this way.  Basically, if mask is something other than
>, you might as well put 0's in your id address.
> This doesnt seem to be how subnet masks normally work and it seems
> redundant to me.
> Is there something I don't understand?

It seems so, or I don't understand what you mean.

Let me repeat your initial configuration:

host    all            ident    sameuser
host    all    password

As the entries in pg_hba.conf are processed on a top-to-bottom,
first-match-wins basis, the first entry here catches any connection
attempt, because the subnet mask covers the whole IPv4 address

If you want an entry to match a single IP address only (e.g. the
loopback address), it has to have all bits 1 in the mask:

host    all    ident    sameuser
host    all    password

It would even work with

host    all          ident    sameuser
host    all    password

because the whole network is reserved for the loopback
device. If you now connect e.g. from PostgreSQL evaluates

( & == ( &              ==

... which is obviously false. For the second entry, the equation looks
like this:

( & == ( &                    ==

... which is true, and therefore the second entry is being used.

If now the mask in the first entry is, any IP adress matches:

( & == ( &              ==

... and therefore the second entry is never being checked.


In response to

pgsql-bugs by date

Next:From: Попов АндрейDate: 2002-06-19 13:06:13
Subject: I have problem with pg_dump in PostgreSQL 7.1.2
Previous:From: Bruce MomjianDate: 2002-06-18 16:42:36
Subject: Re: pg_hba.conf confusion

Privacy Policy | About PostgreSQL
Copyright © 1996-2017 The PostgreSQL Global Development Group