pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedAre dns CNAME's allowed or useable in pg_hba.conf hostname specification
7+ messages / 5 participants
[nested] [flat]
* Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
@ 2016-12-05 21:49 dennisr@visi.com <dennisr@visi.com>
0 siblings, 1 reply; 7+ messages in thread
From: dennisr@visi.com @ 2016-12-05 21:49 UTC (permalink / raw)
To: pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
@ 2016-12-05 21:56 Scott Whitney <scott@journyx.com>
parent: dennisr@visi.com <dennisr@visi.com>
0 siblings, 2 replies; 7+ messages in thread
From: Scott Whitney @ 2016-12-05 21:56 UTC (permalink / raw)
To: dennisr@visi.com <dennisr@visi.com>; pgsql-admin
Honestly, if your DNS is properly setup, it should work fine, yes.
________________________________
From: pgsql-admin-owner@postgresql.org <pgsql-admin-owner@postgresql.org> on behalf of dennisr@visi.com <dennisr@visi.com>
Sent: Monday, December 5, 2016 3:49 PM
To: pgsql-admin@postgresql.org
Subject: [ADMIN] Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
@ 2016-12-05 22:39 David G. Johnston <david.g.johnston@gmail.com>
parent: Scott Whitney <scott@journyx.com>
1 sibling, 0 replies; 7+ messages in thread
From: David G. Johnston @ 2016-12-05 22:39 UTC (permalink / raw)
To: Scott Whitney <scott@journyx.com>; +Cc: dennisr@visi.com <dennisr@visi.com>; pgsql-admin
Its conventional to bottom (or inline) posts on these forums.
On Mon, Dec 5, 2016 at 2:56 PM, Scott Whitney <scott@journyx.com> wrote:
> Honestly, if your DNS is properly setup, it should work fine, yes.
>
I don't understand how placing a non-canonical host name in the
pg_hba.conf can ever result in the following condition being true:
"If a host name is specified [...] that name is compared with the result of
a reverse name resolution of the client's IP address (e.g., reverse DNS
lookup, if DNS is used)."
David J.
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
@ 2016-12-05 23:05 dennisr@visi.com <dennisr@visi.com>
parent: Scott Whitney <scott@journyx.com>
1 sibling, 1 reply; 7+ messages in thread
From: dennisr@visi.com @ 2016-12-05 23:05 UTC (permalink / raw)
To: pgsql-admin; +Cc: Scott Whitney <scott@journyx.com>
Thanks for the quick reply. Here’s some details on how we have things configured.
We are using RHEL 7.3, the DNS names below have been changed to protect the innocent or not so innocent depending on your point of view.
If I do a nslookup on the database host against the following CNAME some-cname-host.example.com <http://some-cname-host.example.com/; I get:
$> nslookup some-cname-host.example.com <http://some-cname-host.example.com/;
Server: 10.97.40.215
Address: 10.97.40.215#53
some-cname-host.example.com canonical name = canonical-host-name.example.com.
Name: canonical-host-name.example.com
Address: 10.65.160.213
When I do the reverse lookup on the IP address return above I get the following:
$> nslookup 10.65.160.213
Server: 10.97.40.215
Address: 10.97.40.215#53
213.160.65.10.in-addr.arpa name = canonical-host-name.example.com.
In our pg_hba.conf I have a line:
# TYPE DATABASE USER ADDRESS METHOD
hostssl replication streaming_user_name some-cname-host.example.com <http://some-cname-host.example.com/;
But when I try to connect as the streaming_user_name with the following command, I get the following error (postgresql_hostname is the host where I ran the nslookups above):
bash-4.2$ psql -U streaming_user_name -h postgresql_hostname -c "IDENTIFY_SYSTEM" replication=1
psql: FATAL: no pg_hba.conf entry for replication connection from host "10.65.160.213", user "streaming_user_name", SSL on
FATAL: no pg_hba.conf entry for replication connection from host "10.65.160.213", user "streaming_user_name", SSL off
So I am not sure what I would need to fix or add on the database host to allow it to resolve the CNAME in way the postgres instance could use it and have it pass the validation rules from the documentation. Am I missing something in the DNS configurations?
> On Dec 5, 2016, at 3:56 PM, Scott Whitney <scott@journyx.com> wrote:
>
> Honestly, if your DNS is properly setup, it should work fine, yes.
>
>
> From: pgsql-admin-owner@postgresql.org <pgsql-admin-owner@postgresql.org> on behalf of dennisr@visi.com <dennisr@visi.com>
> Sent: Monday, December 5, 2016 3:49 PM
> To: pgsql-admin@postgresql.org
> Subject: [ADMIN] Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
>
> From reading the doc’s it looks like a CNAME will not in general work as a hostname specification in pg_hba.conf. Is that a correct interpretation of the the documentation?
>
> From the doc’s ( <applewebdata://41AE75A7-280D-4198-80B2-06378CDDBF25>https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html
>
> If a host name is specified (anything that is not an IP address range or a special key word is treated as a host name), that name is compared with the result of a reverse name resolution of the client's IP address (e.g., reverse DNS lookup, if DNS is used). Host name comparisons are case insensitive. If there is a match, then a forward name resolution (e.g., forward DNS lookup) is performed on the host name to check whether any of the addresses it resolves to are equal to the client's IP address. If both directions match, then the entry is considered to match. (The host name that is used in pg_hba.conf should be the one that address-to-name resolution of the client's IP address returns, otherwise the line won't be matched. Some host name databases allow associating an IP address with multiple host names, but the operating system will only return one host name when asked to resolve an IP address.)
>
>
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org <mailto:pgsql-admin@postgresql.org>)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin <http://www.postgresql.org/mailpref/pgsql-admin;
>
>
> Journyx, Inc.
> 7600 Burnet Road #300
> Austin, TX 78757
> www.journyx.com <http://www.journyx.com/;
>
> p 512.834.8888
> f 512-834-8858
>
> Do you receive our promotional emails? You can subscribe or unsubscribe to those emails at http://go.journyx.com/emailPreference/e/4932/714/ <http://go.journyx.com/emailPreference/e/4932/714/;
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
@ 2016-12-05 23:15 Tom Lane <tgl@sss.pgh.pa.us>
parent: dennisr@visi.com <dennisr@visi.com>
0 siblings, 1 reply; 7+ messages in thread
From: Tom Lane @ 2016-12-05 23:15 UTC (permalink / raw)
To: dennisr@visi.com <dennisr@visi.com>; +Cc: pgsql-admin@postgresql.org, Scott Whitney <scott@journyx.com>
"dennisr@visi.com" <dennisr@visi.com> writes:
> Thanks for the quick reply. Here’s some details on how we have things configured.
> We are using RHEL 7.3, the DNS names below have been changed to protect the innocent or not so innocent depending on your point of view.
> If I do a nslookup on the database host against the following CNAME some-cname-host.example.com <http://some-cname-host.example.com/; I get:
> $> nslookup some-cname-host.example.com <http://some-cname-host.example.com/;
> Server: 10.97.40.215
> Address: 10.97.40.215#53
> some-cname-host.example.com canonical name = canonical-host-name.example.com.
> Name: canonical-host-name.example.com
> Address: 10.65.160.213
> When I do the reverse lookup on the IP address return above I get the following:
> $> nslookup 10.65.160.213
> Server: 10.97.40.215
> Address: 10.97.40.215#53
> 213.160.65.10.in-addr.arpa name = canonical-host-name.example.com.
Given that, what you would have to put in pg_hba.conf is
canonical-host-name.example.com (and that needs to forward-resolve to
10.65.160.213, and possibly other addresses as well). This cross-check
is meant to prevent getting into a PG server by means of a faked
reverse-DNS entry.
(If you're wondering why we don't simply accept anything that
some-cname-host.example.com forward-maps to, it's for performance reasons:
that would require resolving every DNS name in pg_hba.conf to see if it
matches, which could be pretty awful with long pg_hba.conf files.)
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
@ 2016-12-06 00:09 dennisr@visi.com <dennisr@visi.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 7+ messages in thread
From: dennisr@visi.com @ 2016-12-06 00:09 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin@postgresql.org, Scott Whitney <scott@journyx.com>
> On Dec 5, 2016, at 5:15 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> "dennisr@visi.com" <dennisr@visi.com> writes:
>> Thanks for the quick reply. Here’s some details on how we have things configured.
>> We are using RHEL 7.3, the DNS names below have been changed to protect the innocent or not so innocent depending on your point of view.
>
>> If I do a nslookup on the database host against the following CNAME some-cname-host.example.com <http://some-cname-host.example.com/; I get:
>
>> $> nslookup some-cname-host.example.com <http://some-cname-host.example.com/;
>> Server: 10.97.40.215
>> Address: 10.97.40.215#53
>
>> some-cname-host.example.com canonical name = canonical-host-name.example.com.
>> Name: canonical-host-name.example.com
>> Address: 10.65.160.213
>
>> When I do the reverse lookup on the IP address return above I get the following:
>
>> $> nslookup 10.65.160.213
>> Server: 10.97.40.215
>> Address: 10.97.40.215#53
>
>> 213.160.65.10.in-addr.arpa name = canonical-host-name.example.com.
>
> Given that, what you would have to put in pg_hba.conf is
> canonical-host-name.example.com (and that needs to forward-resolve to
> 10.65.160.213, and possibly other addresses as well). This cross-check
> is meant to prevent getting into a PG server by means of a faked
> reverse-DNS entry.
>
> (If you're wondering why we don't simply accept anything that
> some-cname-host.example.com forward-maps to, it's for performance reasons:
> that would require resolving every DNS name in pg_hba.conf to see if it
> matches, which could be pretty awful with long pg_hba.conf files.)
>
> regards, tom lane
>
OK thanks, sadly not the answer I was hoping for though.
My preference is to use a network address for this stuff but I was over ruled and needed to use a host specific name or address in the config file. I wanted to use a CNAME in place of the A or PTR records so as in the event we ever have to rebuild a new WAL receiver, I would only need to repoint the CNAME in the DNS system and avoid the possibility of updating a few hundred pg_hba.conf’s with a new IP address or hostname (this is a private cloud environment I am working with so I don’t have a lot of control over hostnames of the nodes they give me or even the networks the node is placed in.)
Dennis
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
@ 2016-12-08 13:55 Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
parent: dennisr@visi.com <dennisr@visi.com>
0 siblings, 0 replies; 7+ messages in thread
From: Peter Eisentraut @ 2016-12-08 13:55 UTC (permalink / raw)
To: dennisr@visi.com <dennisr@visi.com>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin@postgresql.org, Scott Whitney <scott@journyx.com>
On 12/5/16 7:09 PM, dennisr@visi.com wrote:
> My preference is to use a network address for this stuff but I was over ruled and needed to use a host specific name or address in the config file. I wanted to use a CNAME in place of the A or PTR records so as in the event we ever have to rebuild a new WAL receiver, I would only need to repoint the CNAME in the DNS system and avoid the possibility of updating a few hundred pg_hba.conf’s with a new IP address or hostname (this is a private cloud environment I am working with so I don’t have a lot of control over hostnames of the nodes they give me or even the networks the node is placed in.)
Note that the IP addresses in pg_hba.conf are not really by themselves a
primary security measure, because the source IP addresses in the same
network are (potentially) under control of the source host. Their
purpose is rather to allow different classes of hosts to use different
authentication mechanisms. For example, newer hosts might use SSL,
older hosts passwords.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2016-12-08 13:55 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2016-12-05 21:49 Are dns CNAME's allowed or useable in pg_hba.conf hostname specification dennisr@visi.com <dennisr@visi.com>
2016-12-05 21:56 ` Scott Whitney <scott@journyx.com>
2016-12-05 22:39 ` David G. Johnston <david.g.johnston@gmail.com>
2016-12-05 23:05 ` dennisr@visi.com <dennisr@visi.com>
2016-12-05 23:15 ` Tom Lane <tgl@sss.pgh.pa.us>
2016-12-06 00:09 ` dennisr@visi.com <dennisr@visi.com>
2016-12-08 13:55 ` Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox