From: Sathesh S <Sathesh.Sundaram@hotmail.com>
To: John Scalia <jayknowsunix@gmail.com>
Cc: pgsql-admin@postgresql.org <pgsql-admin@postgresql.org>
Subject: Re: Basic question on 'reject' auth-method in pg_hba.conf
Date: Thu, 1 Dec 2016 05:11:12 +0000
Message-ID: <AM5PR10MB0689434A00DBC8CF5209AC58828F0@AM5PR10MB0689.EURPRD10.PROD.OUTLOOK.COM> (raw)
In-Reply-To: <CABzCKRB5yCYQB5AsSDDtzXxKMs5x61BU0OTbDYaAUCj1VTqjqA@mail.gmail.com>
References: <AM5PR10MB068902CBAA704A68CEA2FB79828C0@AM5PR10MB0689.EURPRD10.PROD.OUTLOOK.COM>
<CABzCKRB5yCYQB5AsSDDtzXxKMs5x61BU0OTbDYaAUCj1VTqjqA@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
Hi Jay,
Thanks for the response.
Just to confirm, do you mean I need to make entries to allow connections for “test” user apart from the reject ones?
I was under assumption that if I make the reject entries, all other connections coming apart from the reject IP’s will be accepted by default.
So, if I need to make entries for both “reject” & to allow connections for “test” user, which one should be on the top (reject entry or allow entry)
Please suggest.
Thanks,
Sathesh
From: John Scalia<mailto:jayknowsunix@gmail.com>
Sent: Wednesday, November 30, 2016 10:22 PM
To: Sathesh S<mailto:Sathesh.Sundaram@hotmail.com>
Cc: pgsql-admin@postgresql.org<mailto:pgsql-admin@postgresql.org>
Subject: Re: [ADMIN] Basic question on 'reject' auth-method in pg_hba.conf
Yes, you'll need to make 2 entries like you shown as no CIDR that I know of other than 0.0.0.0/0<http://0.0.0.0/0; would block both of those, and obviously you do NOT want to block everyone which 0.0.0.0/0<http://0.0.0.0/0; would do. The entries are scanned during a connection attempt, so if your test user is coming from a different IP address than these two, there needs to be another entry permitting that.
--
Jay
On Wed, Nov 30, 2016 at 11:36 AM, Sathesh S <Sathesh.Sundaram@hotmail.com<mailto:Sathesh.Sundaram@hotmail.com>> wrote:
Hello All,
I'm new to postgresql, I have a basic question in using the 'reject' auth-method in pg_hba.conf.
I would like to reject a particular login from multiple range of IP addresses.
For example:
I want to reject login "test" from multiple IP ranges "100.101.13.0" & "200.101.13.0"
My questions:
1. Do I need to make separate entires like below ones or can I separate the IP address range using comma?
"host all test 100.101.13.0 reject"
"host all test 200.101.13.0 reject"
2. If I make multiple entries to reject as above, how will it be treated, will the system read all the entries for the "test" login or will it stop after it finds the 1st entry for "test" login?
Can you please help with above questions.
Thanks,
Sathesh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: Sathesh.Sundaram@hotmail.com, jayknowsunix@gmail.com
Subject: Re: Basic question on 'reject' auth-method in pg_hba.conf
In-Reply-To: <AM5PR10MB0689434A00DBC8CF5209AC58828F0@AM5PR10MB0689.EURPRD10.PROD.OUTLOOK.COM>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox