Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1ZkiMV-00029e-Ls for pgsql-admin@arkaria.postgresql.org; Sat, 10 Oct 2015 00:50:11 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84) (envelope-from ) id 1ZkiMT-0005Xv-Nt for pgsql-admin@arkaria.postgresql.org; Sat, 10 Oct 2015 00:50:09 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84) (envelope-from ) id 1ZkiMS-0005Vw-9Q for pgsql-admin@postgresql.org; Sat, 10 Oct 2015 00:50:08 +0000 Received: from mailout.easymail.ca ([64.68.201.169]) by magus.postgresql.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.84) (envelope-from ) id 1ZkiMK-0005Vh-ES for pgsql-admin@postgresql.org; Sat, 10 Oct 2015 00:50:04 +0000 Received: from localhost (localhost [127.0.0.1]) by mailout.easymail.ca (Postfix) with ESMTP id 58BB8E1C8; Fri, 9 Oct 2015 20:49:56 -0400 (EDT) X-Virus-Scanned: Debian amavisd-new at mailout.easymail.ca X-Spam-Flag: NO X-Spam-Score: -3.808 X-Spam-Level: X-Spam-Status: No, score=-3.808 required=5 tests=[ALL_TRUSTED=-1.8, AWL=-0.101, BAYES_00=-2.599, DNS_FROM_AHBL_RHSBL=0.692] Received: from mailout.easymail.ca ([127.0.0.1]) by localhost (easymail-mailout.easydns.vpn [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WZtmMY8p8anK; Fri, 9 Oct 2015 20:49:56 -0400 (EDT) Received: from [192.168.2.16] (unknown [8.39.228.5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailout.easymail.ca (Postfix) with ESMTPSA id C38F9E194; Fri, 9 Oct 2015 20:49:55 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) Subject: Re: streaming rep setup in PCI compliance environment From: Scott Ribe In-Reply-To: Date: Fri, 9 Oct 2015 18:49:56 -0600 Cc: pgsql-admin@postgresql.org Content-Transfer-Encoding: quoted-printable Message-Id: <34DA3A67-CED4-48D1-83D9-DF70BB3AA3A7@elevated-dev.com> References: To: dinesh bhandary X-Mailer: Apple Mail (2.2104) X-Pg-Spam-Score: -2.6 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org On Oct 9, 2015, at 10:48 AM, dinesh bhandary wrote: >=20 > I am trying to setup streaming rep between master ( which is in PCI tier1= zone) to slave ( PCI tier 2 zone). However, I am told that PCI tier1 can o= nly initiate connection to lower security zone, in our case slave environme= nt ( PCI tier 2). However, for streaming rep to work, slave needs to connec= t to Master. Does this violate PCI requirement. Anyone has experience setti= ng up master-salve in PCI compliance environment?=20 I have a simliar situation in which I do not want anything in my replica's = zone to be able to initiate connections into the data center where the prim= ary is. I have the master set up an SSH reverse tunnel to the slave, and th= en the slave connects to that tunnel end locally. --=20 Scott Ribe scott_ribe@elevated-dev.com http://www.elevated-dev.com/ https://www.linkedin.com/in/scottribe/ (303) 722-0567 voice --=20 Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-admin