From: Scott Ribe <scott_ribe@elevated-dev.com>
To: dinesh bhandary <dbhandary@gmail.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: streaming rep setup in PCI compliance environment
Date: Fri, 9 Oct 2015 18:49:56 -0600
Message-ID: <34DA3A67-CED4-48D1-83D9-DF70BB3AA3A7@elevated-dev.com> (raw)
In-Reply-To: <CAJfZMPxtb_UJp4w3qwKk+bKJogM0KHkyMHVcwdyX=dx9aou7HA@mail.gmail.com>
References: <CAJfZMPxtb_UJp4w3qwKk+bKJogM0KHkyMHVcwdyX=dx9aou7HA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
On Oct 9, 2015, at 10:48 AM, dinesh bhandary <dbhandary@gmail.com> wrote:
>
> I am trying to setup streaming rep between master ( which is in PCI tier1 zone) to slave ( PCI tier 2 zone). However, I am told that PCI tier1 can only initiate connection to lower security zone, in our case slave environment ( PCI tier 2). However, for streaming rep to work, slave needs to connect to Master. Does this violate PCI requirement. Anyone has experience setting up master-salve in PCI compliance environment?
I have a simliar situation in which I do not want anything in my replica's zone to be able to initiate connections into the data center where the primary is. I have the master set up an SSH reverse tunnel to the slave, and then the slave connects to that tunnel end locally.
--
Scott Ribe
scott_ribe@elevated-dev.com
http://www.elevated-dev.com/https://www.linkedin.com/in/scottribe/
(303) 722-0567 voice
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: scott_ribe@elevated-dev.com, dbhandary@gmail.com
Subject: Re: streaming rep setup in PCI compliance environment
In-Reply-To: <34DA3A67-CED4-48D1-83D9-DF70BB3AA3A7@elevated-dev.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox