From: Tom Lane <tgl@sss.pgh.pa.us>
To: "dennisr@visi.com" <dennisr@visi.com>
cc: pgsql-admin@postgresql.org, Scott Whitney <scott@journyx.com>
Subject: Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname
 specification
In-reply-to: <369ED3B4-CAF3-4BBB-904F-E86999249D8E@visi.com>
References: <576363D5-19B5-4B34-A3C1-4D8BF63D3C78@visi.com>
 <712E05C9-E2D7-49CD-834E-26BA911C8D8A@visi.com>
 <BY1PR11MB0390734F0F24454DE44844CFA7830@BY1PR11MB0390.namprd11.prod.outlook.com>
 <369ED3B4-CAF3-4BBB-904F-E86999249D8E@visi.com>
Comments: In-reply-to "dennisr@visi.com" <dennisr@visi.com>
	message dated "Mon, 05 Dec 2016 17:05:59 -0600"
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <3119.1480979712.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 05 Dec 2016 18:15:12 -0500
Message-ID: <3120.1480979712@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

"dennisr@visi.com" <dennisr@visi.com> writes:
> Thanks for the quick reply.  Here=E2=80=99s some details on how we have t=
hings configured.
> We are using RHEL 7.3,  the DNS names below have been changed to protect =
the innocent or not so innocent depending on your point of view.

> If I do a nslookup on the database host against the following CNAME some-=
cname-host.example.com <http://some-cname-host.example.com/> I get:

> 	$> nslookup  some-cname-host.example.com <http://some-cname-host.example=
.com/>
> 	Server:             10.97.40.215
> 	Address:          10.97.40.215#53

> 	some-cname-host.example.com         canonical name =3D canonical-host-na=
me.example.com.
> 	Name: canonical-host-name.example.com
> 	Address: 10.65.160.213
=20
> When I do the reverse lookup on the IP address return above I get the fol=
lowing:

> 	$> nslookup 10.65.160.213
> 	Server:             10.97.40.215
> 	Address:          10.97.40.215#53

> 	213.160.65.10.in-addr.arpa    name =3D canonical-host-name.example.com.

Given that, what you would have to put in pg_hba.conf is
canonical-host-name.example.com (and that needs to forward-resolve to
10.65.160.213, and possibly other addresses as well).  This cross-check
is meant to prevent getting into a PG server by means of a faked
reverse-DNS entry.

(If you're wondering why we don't simply accept anything that
some-cname-host.example.com forward-maps to, it's for performance reasons:
that would require resolving every DNS name in pg_hba.conf to see if it
matches, which could be pretty awful with long pg_hba.conf files.)

			regards, tom lane


--=20
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin