pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedAcess Control !
10+ messages / 5 participants
[nested] [flat]
* Acess Control !
@ 2017-10-03 13:46 Elson Vaz <elsonlei@gmail.com>
0 siblings, 1 reply; 10+ messages in thread
From: Elson Vaz @ 2017-10-03 13:46 UTC (permalink / raw)
To: pgsql-admin
gentlemen,
i have one system that conect with one specific user to data base, so i
want block acess for this user only if he come from the aplication server.
Thank you
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-03 14:03 David G. Johnston <david.g.johnston@gmail.com>
parent: Elson Vaz <elsonlei@gmail.com>
0 siblings, 1 reply; 10+ messages in thread
From: David G. Johnston @ 2017-10-03 14:03 UTC (permalink / raw)
To: Elson Vaz <elsonlei@gmail.com>; +Cc: pgsql-admin
On Tue, Oct 3, 2017 at 6:46 AM, Elson Vaz <elsonlei@gmail.com> wrote:
> gentlemen,
>
> i have one system that conect with one specific user to data base, so i
> want block acess for this user only if he come from the aplication server.
>
>
https://www.postgresql.org/docs/9.6/static/client-authentication.html
The pg_hba.conf file is going to be required since you want the access to
be conditional on the machine and grant/revoke cannot do that.
David J.
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-03 14:56 Elson Vaz <elsonlei@gmail.com>
parent: David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 1 reply; 10+ messages in thread
From: Elson Vaz @ 2017-10-03 14:56 UTC (permalink / raw)
To: David G. Johnston <david.g.johnston@gmail.com>; +Cc: pgsql-admin
thank you David J.,
But how i can do this?
for exemple i did this configuration, but is wroge.
# TYPE DATABASE USER ADDRESS METHOD
host xpto system 10.75.15.60/32 md5
host xpto system 10.72.18.0/24 reject
i want that user *system, *only conect to xpto database if it come from
10.75.15.60, but if this user *"system" *come from another adress i want
reject this connection, it's possible?
2017-10-03 13:03 GMT-01:00 David G. Johnston <david.g.johnston@gmail.com>:
> On Tue, Oct 3, 2017 at 6:46 AM, Elson Vaz <elsonlei@gmail.com> wrote:
>
>> gentlemen,
>>
>> i have one system that conect with one specific user to data base, so i
>> want block acess for this user only if he come from the aplication server.
>>
>>
> https://www.postgresql.org/docs/9.6/static/client-authentication.html
>
> The pg_hba.conf file is going to be required since you want the access to
> be conditional on the machine and grant/revoke cannot do that.
>
> David J.
>
>
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-03 15:01 Scott Mead <scottm@openscg.com>
parent: Elson Vaz <elsonlei@gmail.com>
0 siblings, 1 reply; 10+ messages in thread
From: Scott Mead @ 2017-10-03 15:01 UTC (permalink / raw)
To: Elson Vaz <elsonlei@gmail.com>; +Cc: David G. Johnston <david.g.johnston@gmail.com>; pgsql-admin
On Tue, Oct 3, 2017 at 10:56 AM, Elson Vaz <elsonlei@gmail.com> wrote:
> thank you David J.,
>
> But how i can do this?
> for exemple i did this configuration, but is wroge.
>
> # TYPE DATABASE USER ADDRESS METHOD
> host xpto system 10.75.15.60/32 md5
> host xpto system 10.72.18.0/24
> reject
>
host xpto system 0.0.0.0/0
reject
Make sure to reload the DB when done.
--Scott
>
>
> i want that user *system, *only conect to xpto database if it come from
> 10.75.15.60, but if this user *"system" *come from another adress i want
> reject this connection, it's possible?
>
>
>
>
>
> 2017-10-03 13:03 GMT-01:00 David G. Johnston <david.g.johnston@gmail.com>:
>
>> On Tue, Oct 3, 2017 at 6:46 AM, Elson Vaz <elsonlei@gmail.com> wrote:
>>
>>> gentlemen,
>>>
>>> i have one system that conect with one specific user to data base, so i
>>> want block acess for this user only if he come from the aplication server.
>>>
>>>
>> https://www.postgresql.org/docs/9.6/static/client-authentication.html
>>
>> The pg_hba.conf file is going to be required since you want the access to
>> be conditional on the machine and grant/revoke cannot do that.
>>
>> David J.
>>
>>
>
>
--
--
Scott Mead
Sr. Architect
*OpenSCG <http://openscg.com>*
http://openscg.com
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-03 18:07 Elson Vaz <elsonlei@gmail.com>
parent: Scott Mead <scottm@openscg.com>
0 siblings, 1 reply; 10+ messages in thread
From: Elson Vaz @ 2017-10-03 18:07 UTC (permalink / raw)
To: Scott Mead <scottm@openscg.com>; +Cc: David G. Johnston <david.g.johnston@gmail.com>; pgsql-admin
Thank you my friend, it's work good,
but i changed the position of reject, like that:
# TYPE DATABASE USER ADDRESS METHOD
>
host xpto system 10.72.18.0/24 reject
>
host xpto system 0.0.0.0/0
reject
> host xpto system 10.75.15.60/32 md5
>
>
thank again.
2017-10-03 14:01 GMT-01:00 Scott Mead <scottm@openscg.com>:
>
>
> On Tue, Oct 3, 2017 at 10:56 AM, Elson Vaz <elsonlei@gmail.com> wrote:
>
>> thank you David J.,
>>
>> But how i can do this?
>> for exemple i did this configuration, but is wroge.
>>
>> # TYPE DATABASE USER ADDRESS METHOD
>> host xpto system 10.75.15.60/32 md5
>> host xpto system 10.72.18.0/24
>> reject
>>
> host xpto system 0.0.0.0/0
> reject
>
> Make sure to reload the DB when done.
>
> --Scott
>
>
>>
>>
>> i want that user *system, *only conect to xpto database if it come from
>> 10.75.15.60, but if this user *"system" *come from another adress i want
>> reject this connection, it's possible?
>>
>>
>>
>>
>>
>> 2017-10-03 13:03 GMT-01:00 David G. Johnston <david.g.johnston@gmail.com>
>> :
>>
>>> On Tue, Oct 3, 2017 at 6:46 AM, Elson Vaz <elsonlei@gmail.com> wrote:
>>>
>>>> gentlemen,
>>>>
>>>> i have one system that conect with one specific user to data base, so i
>>>> want block acess for this user only if he come from the aplication server.
>>>>
>>>>
>>> https://www.postgresql.org/docs/9.6/static/client-authentication.html
>>>
>>> The pg_hba.conf file is going to be required since you want the access
>>> to be conditional on the machine and grant/revoke cannot do that.
>>>
>>> David J.
>>>
>>>
>>
>>
>
>
> --
> --
> Scott Mead
> Sr. Architect
> *OpenSCG <http://openscg.com>*
> http://openscg.com
>
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-03 21:55 pinker <pinker@onet.eu>
parent: Elson Vaz <elsonlei@gmail.com>
0 siblings, 1 reply; 10+ messages in thread
From: pinker @ 2017-10-03 21:55 UTC (permalink / raw)
To: pgsql-admin
be careful with order change. This proposed by Scott was correct; yours will
reject all the connections made by user system to xpto. Documentation says:
> The first record with a matching connection type, client address,
> requested database, and user name is used to perform authentication. There
> is no "fall-through" or "backup": if one record is chosen and the
> authentication fails, subsequent records are not considered.
--
Sent from: http://www.postgresql-archive.org/PostgreSQL-admin-f2076596.html
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-04 10:40 Elson Vaz <elsonlei@gmail.com>
parent: pinker <pinker@onet.eu>
0 siblings, 1 reply; 10+ messages in thread
From: Elson Vaz @ 2017-10-04 10:40 UTC (permalink / raw)
To: pinker <pinker@onet.eu>; +Cc: pgsql-admin
Good morning pinker,
Thank you for approch, but i maked this teste:
1. Reject xpto connection from all adress and after acept xpto
connection from this adress - result = work good (lock connection for
xtpo come from other adress and acept from this adress)
# TYPE DATABASE USER ADDRESS METHOD
>
> host xpto system 10.72.18.0/24
> reject
>
> host xpto system 0.0.0.0/0
reject
host xpto system 10.75.15.60/32 md5
host all all *0.0.0.0/0
<http://0.0.0.0/0>* md5
1. acept xpto connection from especific adress and after reject from
all connection - result = (acept all connection, that come from all
adress )
# TYPE DATABASE USER ADDRESS METHOD
>
> host xpto system 10.75.15.60/32 md5
>
> host all all *0.0.0.0/0
<http://0.0.0.0/0>* md5
host xpto system
10.72.18.0/24 reject
host xpto system 0.0.0.0/0
reject
So, maybe the read come from up to down? or have other explanation? i don't
know, i use postgres 9.4.
2017-10-03 20:55 GMT-01:00 pinker <pinker@onet.eu>:
> be careful with order change. This proposed by Scott was correct; yours
> will
> reject all the connections made by user system to xpto. Documentation says:
>
> > The first record with a matching connection type, client address,
> > requested database, and user name is used to perform authentication.
> There
> > is no "fall-through" or "backup": if one record is chosen and the
> > authentication fails, subsequent records are not considered.
>
>
>
>
>
> --
> Sent from: http://www.postgresql-archive.org/PostgreSQL-admin-f2076596.
> html
>
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin
>
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-04 11:01 Vasanth R <rvasanth@gmail.com>
parent: Elson Vaz <elsonlei@gmail.com>
0 siblings, 1 reply; 10+ messages in thread
From: Vasanth R @ 2017-10-04 11:01 UTC (permalink / raw)
To: Elson Vaz <elsonlei@gmail.com>; pinker <pinker@onet.eu>; +Cc: pgsql-admin
It is read from up to down until specific criteria is true. It stops there
and doesn't read thru rest of the lines.
On Wed, Oct 4, 2017 at 06:41 Elson Vaz <elsonlei@gmail.com> wrote:
> Good morning pinker,
>
>
> Thank you for approch, but i maked this teste:
>
> 1. Reject xpto connection from all adress and after acept xpto
> connection from this adress - result = work good (lock connection for
> xtpo come from other adress and acept from this adress)
>
>
> # TYPE DATABASE USER ADDRESS METHOD
>>
>> host xpto system 10.72.18.0/24
>> reject
>>
>> host xpto system 0.0.0.0/0
> reject
> host xpto system 10.75.15.60/32 md5
>
> host all all *0.0.0.0/0
> <http://0.0.0.0/0>* md5
>
>
>
> 1. acept xpto connection from especific adress and after reject
> from all connection - result = (acept all connection, that come from
> all adress )
>
>
>
> # TYPE DATABASE USER ADDRESS METHOD
>>
>>
>
> host xpto system 10.75.15.60/32 md5
>>
>>
>
> host all all *0.0.0.0/0
> <http://0.0.0.0/0>* md5
>
>
> host xpto system
> 10.72.18.0/24 reject
> host xpto system
> 0.0.0.0/0 reject
>
>
>
>
>
> So, maybe the read come from up to down? or have other explanation? i
> don't know, i use postgres 9.4.
>
> 2017-10-03 20:55 GMT-01:00 pinker <pinker@onet.eu>:
>
>> be careful with order change. This proposed by Scott was correct; yours
>> will
>> reject all the connections made by user system to xpto. Documentation
>> says:
>>
>> > The first record with a matching connection type, client address,
>> > requested database, and user name is used to perform authentication.
>> There
>> > is no "fall-through" or "backup": if one record is chosen and the
>> > authentication fails, subsequent records are not considered.
>>
>>
>>
>>
>>
>> --
>> Sent from:
>> http://www.postgresql-archive.org/PostgreSQL-admin-f2076596.html
>>
>>
>> --
>> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
>> To make changes to your subscription:
>> http://www.postgresql.org/mailpref/pgsql-admin
>>
>
> --
Thanks
Vasanth
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-04 11:16 Elson Vaz <elsonlei@gmail.com>
parent: Vasanth R <rvasanth@gmail.com>
0 siblings, 1 reply; 10+ messages in thread
From: Elson Vaz @ 2017-10-04 11:16 UTC (permalink / raw)
To: Vasanth R <rvasanth@gmail.com>; +Cc: pinker <pinker@onet.eu>; pgsql-admin
Okay, thanks, so why not block the xpto connection coming from 10.75.15.60,
as we can see, the first configuration could block it ??
# TYPE DATABASE USER ADDRESS METHOD
>
> host xpto system 10.72.18.0/24
> reject
>
> host xpto system 0.0.0.0/0
reject
host xpto system 10.75.15.60/32 md5
host all all *0.0.0.0/0
<http://0.0.0.0/0>* md5
2017-10-04 10:01 GMT-01:00 Vasanth R <rvasanth@gmail.com>:
> It is read from up to down until specific criteria is true. It stops there
> and doesn't read thru rest of the lines.
>
> On Wed, Oct 4, 2017 at 06:41 Elson Vaz <elsonlei@gmail.com> wrote:
>
>> Good morning pinker,
>>
>>
>> Thank you for approch, but i maked this teste:
>>
>> 1. Reject xpto connection from all adress and after acept xpto
>> connection from this adress - result = work good (lock connection
>> for xtpo come from other adress and acept from this adress)
>>
>>
>> # TYPE DATABASE USER ADDRESS METHOD
>>>
>>> host xpto system 10.72.18.0/24
>>> reject
>>>
>>> host xpto system 0.0.0.0/0
>> reject
>> host xpto system 10.75.15.60/32
>> md5
>>
>> host all all *0.0.0.0/0
>> <http://0.0.0.0/0>* md5
>>
>>
>>
>> 1. acept xpto connection from especific adress and after reject
>> from all connection - result = (acept all connection, that come from
>> all adress )
>>
>>
>>
>> # TYPE DATABASE USER ADDRESS METHOD
>>>
>>>
>>
>> host xpto system 10.75.15.60/32
>>> md5
>>>
>>>
>>
>> host all all *0.0.0.0/0
>> <http://0.0.0.0/0>* md5
>>
>>
>> host xpto system
>> 10.72.18.0/24 reject
>> host xpto system
>> 0.0.0.0/0 reject
>>
>>
>>
>>
>>
>> So, maybe the read come from up to down? or have other explanation? i
>> don't know, i use postgres 9.4.
>>
>> 2017-10-03 20:55 GMT-01:00 pinker <pinker@onet.eu>:
>>
>>> be careful with order change. This proposed by Scott was correct; yours
>>> will
>>> reject all the connections made by user system to xpto. Documentation
>>> says:
>>>
>>> > The first record with a matching connection type, client address,
>>> > requested database, and user name is used to perform authentication.
>>> There
>>> > is no "fall-through" or "backup": if one record is chosen and the
>>> > authentication fails, subsequent records are not considered.
>>>
>>>
>>>
>>>
>>>
>>> --
>>> Sent from: http://www.postgresql-archive.org/PostgreSQL-admin-f2076596.
>>> html
>>>
>>>
>>> --
>>> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
>>> To make changes to your subscription:
>>> http://www.postgresql.org/mailpref/pgsql-admin
>>>
>>
>> --
> Thanks
> Vasanth
>
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: Acess Control !
@ 2017-10-04 11:30 Vasanth R <rvasanth@gmail.com>
parent: Elson Vaz <elsonlei@gmail.com>
0 siblings, 0 replies; 10+ messages in thread
From: Vasanth R @ 2017-10-04 11:30 UTC (permalink / raw)
To: Elson Vaz <elsonlei@gmail.com>; +Cc: pinker <pinker@onet.eu>; pgsql-admin
^ permalink raw reply [nested|flat] 10+ messages in thread
end of thread, other threads:[~2017-10-04 11:30 UTC | newest]
Thread overview: 10+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2017-10-03 13:46 Acess Control ! Elson Vaz <elsonlei@gmail.com>
2017-10-03 14:03 ` David G. Johnston <david.g.johnston@gmail.com>
2017-10-03 14:56 ` Elson Vaz <elsonlei@gmail.com>
2017-10-03 15:01 ` Scott Mead <scottm@openscg.com>
2017-10-03 18:07 ` Elson Vaz <elsonlei@gmail.com>
2017-10-03 21:55 ` pinker <pinker@onet.eu>
2017-10-04 10:40 ` Elson Vaz <elsonlei@gmail.com>
2017-10-04 11:01 ` Vasanth R <rvasanth@gmail.com>
2017-10-04 11:16 ` Elson Vaz <elsonlei@gmail.com>
2017-10-04 11:30 ` Vasanth R <rvasanth@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox