From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: albert_schabhuetl@yahoo.de
Subject: BUG #15520: PAM authentication + domain socket -> DNS query for symbolic hostname [local]
Date: Sat, 24 Nov 2018 10:45:54 +0000
Message-ID: <15520-4c266f986998e1c5@postgresql.org> (raw)
The following bug has been logged on the website:
Bug reference: 15520
Logged by: Albert Schabhuetl
Email address: albert_schabhuetl@yahoo.de
PostgreSQL version: 10.4
Operating system: RHEL 7.4
Description:
When PAM authentication is configured for local connections via domain
socket,
during authentication the backend process sends out a DNS query
for the following symbolic hostname: [local]
This is unnecessary as it is not intended that this hostname will ever
resolve to a valid IP address,
and depending on how DNS queries are answered in the actual system it can
cause authentication delays.
Theory why this happens:
Since this commit
https://github.com/postgres/postgres/commit/2f1d2b7a75fecad25295cb3f453503eb6a176d4f#diff-f5a9c53142...
during PAM authenticaion the functions
pg_getnameinfo_all
pam_set_item
are called, in order to support the PAM configuration option
"pam_use_hostname".
In the case of a TCP connection and pam_use_hostname = 0,
pg_getnameinfo_all still calls the library function
getnameinfo
but with flags = 0 to achieve "do nothing" behaviour.
In the case of a domain socket connection,
regardless of pam_use_hostname,
pg_getnameinfo_all calls
getnameinfo_unix,
which ignores the flags parameter and invariably
sets the hostname to a symbolic text - [local] in our case.
When subsequently the PAM library function
pam_set_item
is called, it gets the symbolic hostname [local]
and probably it is this function which sends the DNS request for this
hostname.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, albert_schabhuetl@yahoo.de
Subject: Re: BUG #15520: PAM authentication + domain socket -> DNS query for symbolic hostname [local]
In-Reply-To: <15520-4c266f986998e1c5@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox