Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3251\))
Subject: Re: Are dns CNAME's allowed or useable in pg_hba.conf
 hostname specification
From: "dennisr@visi.com" <dennisr@visi.com>
In-Reply-To: <3120.1480979712@sss.pgh.pa.us>
Date: Mon, 5 Dec 2016 18:09:22 -0600
Cc: pgsql-admin@postgresql.org,
 Scott Whitney <scott@journyx.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <26EFFF38-A2FF-4BCB-A24D-4FD2D9E5E9EB@visi.com>
References: <576363D5-19B5-4B34-A3C1-4D8BF63D3C78@visi.com>
 <712E05C9-E2D7-49CD-834E-26BA911C8D8A@visi.com>
 <BY1PR11MB0390734F0F24454DE44844CFA7830@BY1PR11MB0390.namprd11.prod.outlook.com>
 <369ED3B4-CAF3-4BBB-904F-E86999249D8E@visi.com>
 <3120.1480979712@sss.pgh.pa.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org


> On Dec 5, 2016, at 5:15 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>=20
> "dennisr@visi.com" <dennisr@visi.com> writes:
>> Thanks for the quick reply.  Here=E2=80=99s some details on how we have =
things configured.
>> We are using RHEL 7.3,  the DNS names below have been changed to protect=
 the innocent or not so innocent depending on your point of view.
>=20
>> If I do a nslookup on the database host against the following CNAME some=
-cname-host.example.com <http://some-cname-host.example.com/> I get:
>=20
>> 	$> nslookup  some-cname-host.example.com <http://some-cname-host.exampl=
e.com/>
>> 	Server:             10.97.40.215
>> 	Address:          10.97.40.215#53
>=20
>> 	some-cname-host.example.com         canonical name =3D canonical-host-n=
ame.example.com.
>> 	Name: canonical-host-name.example.com
>> 	Address: 10.65.160.213
>=20
>> When I do the reverse lookup on the IP address return above I get the fo=
llowing:
>=20
>> 	$> nslookup 10.65.160.213
>> 	Server:             10.97.40.215
>> 	Address:          10.97.40.215#53
>=20
>> 	213.160.65.10.in-addr.arpa    name =3D canonical-host-name.example.com.
>=20
> Given that, what you would have to put in pg_hba.conf is
> canonical-host-name.example.com (and that needs to forward-resolve to
> 10.65.160.213, and possibly other addresses as well).  This cross-check
> is meant to prevent getting into a PG server by means of a faked
> reverse-DNS entry.
>=20
> (If you're wondering why we don't simply accept anything that
> some-cname-host.example.com forward-maps to, it's for performance reasons:
> that would require resolving every DNS name in pg_hba.conf to see if it
> matches, which could be pretty awful with long pg_hba.conf files.)
>=20
> 			regards, tom lane
>=20

OK thanks, sadly not the answer I was hoping for though.=20=20

My preference is to use a network address for this stuff but I was over rul=
ed and needed to use a host specific name or address in the config file. I =
wanted to use a CNAME in place of the A or PTR records so as in the event w=
e ever have to rebuild a new WAL receiver, I would only need to repoint the=
 CNAME in the DNS system and avoid the possibility of updating a few hundre=
d pg_hba.conf=E2=80=99s with a new IP address or hostname (this is a privat=
e cloud environment I am working with so I don=E2=80=99t have a lot of cont=
rol over hostnames of the nodes they give me or even the networks the node =
is placed in.)

Dennis


--=20
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin