Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cCJgD-0008Sq-Lu for pgsql-admin@arkaria.postgresql.org; Thu, 01 Dec 2016 05:13:09 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1cCJgB-0008TS-8s for pgsql-admin@arkaria.postgresql.org; Thu, 01 Dec 2016 05:13:07 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1cCJeS-0006Z4-Hq for pgsql-admin@postgresql.org; Thu, 01 Dec 2016 05:11:21 +0000 Received: from bay004-omc2s23.hotmail.com ([65.54.190.98]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1cCJeO-0002oD-Vk for pgsql-admin@postgresql.org; Thu, 01 Dec 2016 05:11:19 +0000 Received: from EUR01-VE1-obe.outbound.protection.outlook.com ([65.54.190.124]) by BAY004-OMC2S23.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Wed, 30 Nov 2016 21:11:15 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ETaHVn4LhtGYe3DosTj4bTkcGKZqpcMaJFU5t6SFax4=; b=obO6zy3fkYwIB9+RRNA/d/KMff0ukZjLwYpdCg5eSj72I927vP4g4Z8ydJsMvLMrKIswMx6JKgJvwyNGWefi8+CoOBR/3WIDSQJx7kO/VOikxLM9QV7OHgZDup/ISSYLv5/mnjKdCPXlkXzFo9kU+cLc54OXyQEldHqackgA/o/p7+msSAjCacgp8ZXtAeiwa80aHzuPfSq5lKnRVG60bBAAWpitfMNiwciciI4oQJUnwghFpG8F25d5XHsLBNMpOidZM32lXuXcom2Pm5Z7TjbzpyxB1FRwUyT3vz+AlLAgxraeYuBu4GnauJHqH1N8qfDjT5zPMSaIgYyKXlFPaA== Received: from HE1EUR01FT045.eop-EUR01.prod.protection.outlook.com (10.152.0.60) by HE1EUR01HT017.eop-EUR01.prod.protection.outlook.com (10.152.1.74) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.4; Thu, 1 Dec 2016 05:11:13 +0000 Received: from AM5PR10MB0689.EURPRD10.PROD.OUTLOOK.COM (10.152.0.59) by HE1EUR01FT045.mail.protection.outlook.com (10.152.0.239) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.734.4 via Frontend Transport; Thu, 1 Dec 2016 05:11:13 +0000 Received: from AM5PR10MB0689.EURPRD10.PROD.OUTLOOK.COM ([10.167.221.145]) by AM5PR10MB0689.EURPRD10.PROD.OUTLOOK.COM ([10.167.221.145]) with mapi id 15.01.0747.018; Thu, 1 Dec 2016 05:11:13 +0000 From: Sathesh S To: John Scalia CC: "pgsql-admin@postgresql.org" Subject: Re: Basic question on 'reject' auth-method in pg_hba.conf Thread-Topic: [ADMIN] Basic question on 'reject' auth-method in pg_hba.conf Thread-Index: AQHSSx8fUFC0VtTFfkuqMH4pDm/Dh6DxvfUAgADOdss= Date: Thu, 1 Dec 2016 05:11:12 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=hotmail.com; x-incomingtopheadermarker: OriginalChecksum:;UpperCasedChecksum:;SizeAsReceived:7630;Count:40 x-ms-exchange-messagesentrepresentingtype: 1 x-tmn: [14ffC2aLUlpgFIl0pFiC7nl9VeEOjtmi] x-incomingheadercount: 40 x-eopattributedmessage: 0 x-microsoft-exchange-diagnostics: 1;HE1EUR01HT017;7:GlW67cjbryQ2KwrooBwoAEANN1p+lQ/QR4D88piYZs3rMdIQ1fT4ciVEFNIsKqN9ZcPsZOdAEi/wxDiYJoezgJucfqvVdlynysn3QsRAZplFhR6xiuQu1UNd+OUuVFO1LwL4V2RFBsr3Bp93k+bQYU0mXS5VsvQcAbTOITYRzuAj/bIcaF3g6F+fC4ROZ/s95YZ1pEKa91XBzWYMOiNqIIxP0vfi+exxLqyyEa0MzdpZ6kUugL7q9XZFKYDEKp9fC2iok4vk3WyWJFgj0vD2CT55yo4PmT1vPAEj7S7zfOGvF/H5os5RFIT5yj/kCsSUFLLEIGhJtABpsQQvtlb56ha3cYuY1Y3LDFEcTkoY9ak= x-forefront-antispam-report: EFV:NLI;SFV:NSPM;SFS:(10019020)(98900003);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1EUR01HT017;H:AM5PR10MB0689.EURPRD10.PROD.OUTLOOK.COM;FPR:;SPF:None;LANG:en; x-ms-office365-filtering-correlation-id: 5c93c008-90a4-479f-1fe8-08d419a8785a x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(1601124038)(1603103113)(1601125047);SRVR:HE1EUR01HT017; x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(432015012)(82015046);SRVR:HE1EUR01HT017;BCL:0;PCL:0;RULEID:;SRVR:HE1EUR01HT017; x-forefront-prvs: 014304E855 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_AM5PR10MB0689434A00DBC8CF5209AC58828F0AM5PR10MB0689EURP_" MIME-Version: 1.0 X-OriginatorOrg: hotmail.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Dec 2016 05:11:12.9143 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1EUR01HT017 X-OriginalArrivalTime: 01 Dec 2016 05:11:15.0930 (UTC) FILETIME=[579B43A0:01D24B91] X-Pg-Spam-Score: -3.9 (---) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org --_000_AM5PR10MB0689434A00DBC8CF5209AC58828F0AM5PR10MB0689EURP_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi Jay, Thanks for the response. Just to confirm, do you mean I need to make entries to allow connections fo= r =93test=94 user apart from the reject ones? I was under assumption that if I make the reject entries, all other connect= ions coming apart from the reject IP=92s will be accepted by default. So, if I need to make entries for both =93reject=94 & to allow connections = for =93test=94 user, which one should be on the top (reject entry or allow = entry) Please suggest. Thanks, Sathesh From: John Scalia Sent: Wednesday, November 30, 2016 10:22 PM To: Sathesh S Cc: pgsql-admin@postgresql.org Subject: Re: [ADMIN] Basic question on 'reject' auth-method in pg_hba.conf Yes, you'll need to make 2 entries like you shown as no CIDR that I know of= other than 0.0.0.0/0 would block both of those, and obvi= ously you do NOT want to block everyone which 0.0.0.0/0 w= ould do. The entries are scanned during a connection attempt, so if your te= st user is coming from a different IP address than these two, there needs t= o be another entry permitting that. -- Jay On Wed, Nov 30, 2016 at 11:36 AM, Sathesh S > wrote: Hello All, I'm new to postgresql, I have a basic question in using the 'reject' auth-m= ethod in pg_hba.conf. I would like to reject a particular login from multiple range of IP address= es. For example: I want to reject login "test" from multiple IP ranges "100.101.13.0" & "200= .101.13.0" My questions: 1. Do I need to make separate entires like below ones or can I separate th= e IP address range using comma? "host all test 100.101.13.0 reject" "host all test 200.101.13.0 reject" 2. If I make multiple entries to reject as above, how will it be treated, w= ill the system read all the entries for the "test" login or will it stop af= ter it finds the 1st entry for "test" login? Can you please help with above questions. Thanks, Sathesh --_000_AM5PR10MB0689434A00DBC8CF5209AC58828F0AM5PR10MB0689EURP_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Hi Jay,

 

Thanks for the response.

 

Just to confirm, do you mean I need to make entries = to allow connections for =93test=94 user apart from the reject ones?

I was under assumption that if I make the reject ent= ries, all other connections coming apart from the  reject IP=92s will = be accepted by default.

 

So, if I need to make entries for both =93reject=94 = & to allow connections for =93test=94 user, which one should be on the = top (reject entry or allow entry)

 

Please suggest.

 

Thanks,

Sathesh

 

 

From: John Scalia
Sent: Wednesday, November 30, 2016 10:22 PM
To: Sathesh S Cc: pgsql-admin@postgr= esql.org
Subject: Re: [ADMIN] Basic question on 'reject' auth-method in pg_hb= a.conf

 

Yes, you'll need to make 2 entries like you shown as no CIDR that I kn= ow of other than 0.0.0.0/0 would block both of those, and o= bviously you do NOT want to block everyone which 0.0.0.0/0 would do. The entries are scanne= d during a connection attempt, so if your test user is coming from a differ= ent IP address than these two, there needs to be another entry permitting t= hat.
--
Jay

On Wed, Nov 30, 2016 at 11:36 AM, Sathesh S <Sathe= sh.Sundaram@hotmail.com> wrote:

Hello All,


I'm new to postgresql, I have a basic que= stion in using the 'reject' auth-method in pg_hba.conf.

I would like to reject a particular login= from multiple range of IP addresses.


For example:


I want to reject login "test" f= rom multiple IP ranges "100.101.13.0" & "200.101.13.0&qu= ot;


My questions:


1.  Do I need to make separate entir= es like below ones or can I separate the IP address range using comma?


"host   all  test  100.101.13.0  reject"

"host   all  test  = 200.101.13.0  reject"

2. If I make multiple entries to reject as a= bove, how will it be treated, will the system read all the entries for the = "test" login or will it stop after it finds the 1st entry for &qu= ot;test" login?

Can you please help with above questions.


Thanks,

Sathesh


--_000_AM5PR10MB0689434A00DBC8CF5209AC58828F0AM5PR10MB0689EURP_--