From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: dennisr@visi.com <dennisr@visi.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-admin@postgresql.org, Scott Whitney <scott@journyx.com>
Subject: Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
Date: Thu, 8 Dec 2016 08:55:20 -0500
Message-ID: <f8435582-03ec-88ed-a67a-ef707b527e34@2ndquadrant.com> (raw)
In-Reply-To: <26EFFF38-A2FF-4BCB-A24D-4FD2D9E5E9EB@visi.com>
References: <576363D5-19B5-4B34-A3C1-4D8BF63D3C78@visi.com>
<712E05C9-E2D7-49CD-834E-26BA911C8D8A@visi.com>
<BY1PR11MB0390734F0F24454DE44844CFA7830@BY1PR11MB0390.namprd11.prod.outlook.com>
<369ED3B4-CAF3-4BBB-904F-E86999249D8E@visi.com>
<3120.1480979712@sss.pgh.pa.us>
<26EFFF38-A2FF-4BCB-A24D-4FD2D9E5E9EB@visi.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
On 12/5/16 7:09 PM, dennisr@visi.com wrote:
> My preference is to use a network address for this stuff but I was over ruled and needed to use a host specific name or address in the config file. I wanted to use a CNAME in place of the A or PTR records so as in the event we ever have to rebuild a new WAL receiver, I would only need to repoint the CNAME in the DNS system and avoid the possibility of updating a few hundred pg_hba.conf’s with a new IP address or hostname (this is a private cloud environment I am working with so I don’t have a lot of control over hostnames of the nodes they give me or even the networks the node is placed in.)
Note that the IP addresses in pg_hba.conf are not really by themselves a
primary security measure, because the source IP addresses in the same
network are (potentially) under control of the source host. Their
purpose is rather to allow different classes of hosts to use different
authentication mechanisms. For example, newer hosts might use SSL,
older hosts passwords.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: peter.eisentraut@2ndquadrant.com, dennisr@visi.com, tgl@sss.pgh.pa.us, scott@journyx.com
Subject: Re: Are dns CNAME's allowed or useable in pg_hba.conf hostname specification
In-Reply-To: <f8435582-03ec-88ed-a67a-ef707b527e34@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox