Subject: Re: streaming rep setup in PCI compliance environment
To: Scott Ribe <scott_ribe@elevated-dev.com>,
 dinesh bhandary <dbhandary@gmail.com>
References: 
 <CAJfZMPxtb_UJp4w3qwKk+bKJogM0KHkyMHVcwdyX=dx9aou7HA@mail.gmail.com>
 <34DA3A67-CED4-48D1-83D9-DF70BB3AA3A7@elevated-dev.com>
Cc: pgsql-admin@postgresql.org
From: "Joshua D. Drake" <jd@commandprompt.com>
Organization: Command Prompt, Inc.
Message-ID: <56187DE1.5060406@commandprompt.com>
Date: Fri, 9 Oct 2015 19:54:25 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.2.0
MIME-Version: 1.0
In-Reply-To: <34DA3A67-CED4-48D1-83D9-DF70BB3AA3A7@elevated-dev.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

On 10/09/2015 05:49 PM, Scott Ribe wrote:
> On Oct 9, 2015, at 10:48 AM, dinesh bhandary <dbhandary@gmail.com> wrote:
>>
>> I am trying to setup streaming rep between master ( which is in PCI tier1 zone) to slave ( PCI tier 2 zone). However, I am told that PCI tier1 can only initiate connection to lower security zone, in our case slave environment ( PCI tier 2). However, for streaming rep to work, slave needs to connect to Master. Does this violate PCI requirement. Anyone has experience setting up master-salve in PCI compliance environment?
>
>
> I have a simliar situation in which I do not want anything in my replica's zone to be able to initiate connections into the data center where the primary is. I have the master set up an SSH reverse tunnel to the slave, and then the slave connects to that tunnel end locally.
>

You could also just use archiving, hot_standby still works when you do that.

JD


-- 
Command Prompt, Inc. - http://www.commandprompt.com/  503-667-4564
PostgreSQL Centered full stack support, consulting and development.
New rule for social situations: "If you think to yourself not even
JD would say this..." Stop and shut your mouth. It's going to be bad.


-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin