pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedstreaming rep setup in PCI compliance environment
5+ messages / 4 participants
[nested] [flat]
* streaming rep setup in PCI compliance environment
@ 2015-10-09 16:48 dinesh bhandary <dbhandary@gmail.com>
2015-10-09 17:50 ` Re: streaming rep setup in PCI compliance environment John Scalia <jayknowsunix@gmail.com>
2015-10-10 00:49 ` Re: streaming rep setup in PCI compliance environment Scott Ribe <scott_ribe@elevated-dev.com>
0 siblings, 2 replies; 5+ messages in thread
From: dinesh bhandary @ 2015-10-09 16:48 UTC (permalink / raw)
To: pgsql-admin
Hello Everyone:
I am trying to setup streaming rep between master ( which is in PCI tier1
zone) to slave ( PCI tier 2 zone). However, I am told that PCI tier1 can
only initiate connection to lower security zone, in our case slave
environment ( PCI tier 2). However, for streaming rep to work, slave needs
to connect to Master. Does this violate PCI requirement. Anyone has
experience setting up master-salve in PCI compliance environment?
Please let me know.
Thanks
Dinesh
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: streaming rep setup in PCI compliance environment
2015-10-09 16:48 streaming rep setup in PCI compliance environment dinesh bhandary <dbhandary@gmail.com>
@ 2015-10-09 17:50 ` John Scalia <jayknowsunix@gmail.com>
2015-10-09 18:28 ` Re: streaming rep setup in PCI compliance environment dinesh bhandary <dbhandary@gmail.com>
1 sibling, 1 reply; 5+ messages in thread
From: John Scalia @ 2015-10-09 17:50 UTC (permalink / raw)
To: dinesh bhandary <dbhandary@gmail.com>; +Cc: pgsql-admin
I spoke with my PCI compliance officer here, and provided you've documented
what you're doing here and why, you should be compliant. We had a fairly
long discussion about this and I had to explain to him that I was referring
to the slave as being a hot standby, ready to take over in the event of an
issue with the primary. If you're doing this for some other reason, so long
as it's explained, you could still be OK.
--
Jay
On Fri, Oct 9, 2015 at 11:48 AM, dinesh bhandary <dbhandary@gmail.com>
wrote:
> Hello Everyone:
>
> I am trying to setup streaming rep between master ( which is in PCI tier1
> zone) to slave ( PCI tier 2 zone). However, I am told that PCI tier1 can
> only initiate connection to lower security zone, in our case slave
> environment ( PCI tier 2). However, for streaming rep to work, slave needs
> to connect to Master. Does this violate PCI requirement. Anyone has
> experience setting up master-salve in PCI compliance environment?
>
> Please let me know.
>
> Thanks
> Dinesh
>
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: streaming rep setup in PCI compliance environment
2015-10-09 16:48 streaming rep setup in PCI compliance environment dinesh bhandary <dbhandary@gmail.com>
2015-10-09 17:50 ` Re: streaming rep setup in PCI compliance environment John Scalia <jayknowsunix@gmail.com>
@ 2015-10-09 18:28 ` dinesh bhandary <dbhandary@gmail.com>
0 siblings, 0 replies; 5+ messages in thread
From: dinesh bhandary @ 2015-10-09 18:28 UTC (permalink / raw)
To: John Scalia <jayknowsunix@gmail.com>; +Cc: pgsql-admin
Thank you, John.
I am also trying to find from our PCI representative as well. In our case
slave will be used for reporting purpose not for failover.
I guess the biggest dilemma from PCI perspective is tier 2 initiating
connection to tier1, but it is just a db user with replication role, which
is a pretty controlled role.
Dinesh
On Fri, Oct 9, 2015 at 10:50 AM, John Scalia <jayknowsunix@gmail.com> wrote:
> I spoke with my PCI compliance officer here, and provided you've
> documented what you're doing here and why, you should be compliant. We had
> a fairly long discussion about this and I had to explain to him that I was
> referring to the slave as being a hot standby, ready to take over in the
> event of an issue with the primary. If you're doing this for some other
> reason, so long as it's explained, you could still be OK.
> --
> Jay
>
> On Fri, Oct 9, 2015 at 11:48 AM, dinesh bhandary <dbhandary@gmail.com>
> wrote:
>
>> Hello Everyone:
>>
>> I am trying to setup streaming rep between master ( which is in PCI tier1
>> zone) to slave ( PCI tier 2 zone). However, I am told that PCI tier1 can
>> only initiate connection to lower security zone, in our case slave
>> environment ( PCI tier 2). However, for streaming rep to work, slave needs
>> to connect to Master. Does this violate PCI requirement. Anyone has
>> experience setting up master-salve in PCI compliance environment?
>>
>> Please let me know.
>>
>> Thanks
>> Dinesh
>>
>
>
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: streaming rep setup in PCI compliance environment
2015-10-09 16:48 streaming rep setup in PCI compliance environment dinesh bhandary <dbhandary@gmail.com>
@ 2015-10-10 00:49 ` Scott Ribe <scott_ribe@elevated-dev.com>
2015-10-10 02:54 ` Re: streaming rep setup in PCI compliance environment Joshua D. Drake <jd@commandprompt.com>
1 sibling, 1 reply; 5+ messages in thread
From: Scott Ribe @ 2015-10-10 00:49 UTC (permalink / raw)
To: dinesh bhandary <dbhandary@gmail.com>; +Cc: pgsql-admin
On Oct 9, 2015, at 10:48 AM, dinesh bhandary <dbhandary@gmail.com> wrote:
>
> I am trying to setup streaming rep between master ( which is in PCI tier1 zone) to slave ( PCI tier 2 zone). However, I am told that PCI tier1 can only initiate connection to lower security zone, in our case slave environment ( PCI tier 2). However, for streaming rep to work, slave needs to connect to Master. Does this violate PCI requirement. Anyone has experience setting up master-salve in PCI compliance environment?
I have a simliar situation in which I do not want anything in my replica's zone to be able to initiate connections into the data center where the primary is. I have the master set up an SSH reverse tunnel to the slave, and then the slave connects to that tunnel end locally.
--
Scott Ribe
scott_ribe@elevated-dev.com
http://www.elevated-dev.com/
https://www.linkedin.com/in/scottribe/
(303) 722-0567 voice
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: streaming rep setup in PCI compliance environment
2015-10-09 16:48 streaming rep setup in PCI compliance environment dinesh bhandary <dbhandary@gmail.com>
2015-10-10 00:49 ` Re: streaming rep setup in PCI compliance environment Scott Ribe <scott_ribe@elevated-dev.com>
@ 2015-10-10 02:54 ` Joshua D. Drake <jd@commandprompt.com>
0 siblings, 0 replies; 5+ messages in thread
From: Joshua D. Drake @ 2015-10-10 02:54 UTC (permalink / raw)
To: Scott Ribe <scott_ribe@elevated-dev.com>; dinesh bhandary <dbhandary@gmail.com>; +Cc: pgsql-admin
On 10/09/2015 05:49 PM, Scott Ribe wrote:
> On Oct 9, 2015, at 10:48 AM, dinesh bhandary <dbhandary@gmail.com> wrote:
>>
>> I am trying to setup streaming rep between master ( which is in PCI tier1 zone) to slave ( PCI tier 2 zone). However, I am told that PCI tier1 can only initiate connection to lower security zone, in our case slave environment ( PCI tier 2). However, for streaming rep to work, slave needs to connect to Master. Does this violate PCI requirement. Anyone has experience setting up master-salve in PCI compliance environment?
>
>
> I have a simliar situation in which I do not want anything in my replica's zone to be able to initiate connections into the data center where the primary is. I have the master set up an SSH reverse tunnel to the slave, and then the slave connects to that tunnel end locally.
>
You could also just use archiving, hot_standby still works when you do that.
JD
--
Command Prompt, Inc. - http://www.commandprompt.com/ 503-667-4564
PostgreSQL Centered full stack support, consulting and development.
New rule for social situations: "If you think to yourself not even
JD would say this..." Stop and shut your mouth. It's going to be bad.
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2015-10-10 02:54 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2015-10-09 16:48 streaming rep setup in PCI compliance environment dinesh bhandary <dbhandary@gmail.com>
2015-10-09 17:50 ` John Scalia <jayknowsunix@gmail.com>
2015-10-09 18:28 ` dinesh bhandary <dbhandary@gmail.com>
2015-10-10 00:49 ` Scott Ribe <scott_ribe@elevated-dev.com>
2015-10-10 02:54 ` Joshua D. Drake <jd@commandprompt.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox