pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  
help / color / mirror / Atom feed
From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: albert_schabhuetl@yahoo.de
Subject: BUG #15520: PAM authentication + domain socket -> DNS query for symbolic hostname [local]
Date: Sat, 24 Nov 2018 10:45:54 +0000
Message-ID: <15520-4c266f986998e1c5@postgresql.org> (raw)

The following bug has been logged on the website:

Bug reference:      15520
Logged by:          Albert Schabhuetl
Email address:      albert_schabhuetl@yahoo.de
PostgreSQL version: 10.4
Operating system:   RHEL 7.4
Description:        

When PAM authentication is configured for local connections via domain
socket,
during authentication the backend process sends out a DNS query 
for the following symbolic hostname: [local]

This is unnecessary as it is not intended that this hostname will ever
resolve to a valid IP address,
and depending on how DNS queries are answered in the actual system it can
cause authentication delays.

Theory why this happens:

Since this commit
https://github.com/postgres/postgres/commit/2f1d2b7a75fecad25295cb3f453503eb6a176d4f#diff-f5a9c53142...
during PAM authenticaion the functions
	pg_getnameinfo_all
	pam_set_item
are called, in order to support the PAM configuration option
"pam_use_hostname".

In the case of a TCP connection and pam_use_hostname = 0,
	pg_getnameinfo_all still calls the library function
	getnameinfo
but with flags = 0 to achieve "do nothing" behaviour.

In the case of a domain socket connection,
regardless of pam_use_hostname,
	pg_getnameinfo_all calls 
	getnameinfo_unix,
which ignores the flags parameter and invariably
sets the hostname to a symbolic text - [local] in our case.

When subsequently the PAM library function 
	pam_set_item
is called, it gets the symbolic hostname [local]
and probably it is this function which sends the DNS request for this
hostname.



view thread (8+ messages)  latest in thread

Message-ID: <15520-4c266f986998e1c5@postgresql.org>
Permalink:  ../15520-4c266f986998e1c5@postgresql.org/
Also on:    postgresql.org/message-id/15520-4c266f986998e1c5@postgresql.org

 · 

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, albert_schabhuetl@yahoo.de
  Subject: Re: BUG #15520: PAM authentication + domain socket -> DNS query for symbolic hostname [local]
  In-Reply-To: <15520-4c266f986998e1c5@postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox