Subject: Re: Are dns CNAME's allowed or useable in pg_hba.conf
 hostname specification
To: "dennisr@visi.com" <dennisr@visi.com>, Tom Lane <tgl@sss.pgh.pa.us>
References: <576363D5-19B5-4B34-A3C1-4D8BF63D3C78@visi.com>
 <712E05C9-E2D7-49CD-834E-26BA911C8D8A@visi.com>
 <BY1PR11MB0390734F0F24454DE44844CFA7830@BY1PR11MB0390.namprd11.prod.outlook.com>
 <369ED3B4-CAF3-4BBB-904F-E86999249D8E@visi.com>
 <3120.1480979712@sss.pgh.pa.us>
 <26EFFF38-A2FF-4BCB-A24D-4FD2D9E5E9EB@visi.com>
Cc: pgsql-admin@postgresql.org, Scott Whitney <scott@journyx.com>
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Organization: 2ndQuadrant
Message-ID: <f8435582-03ec-88ed-a67a-ef707b527e34@2ndquadrant.com>
Date: Thu, 8 Dec 2016 08:55:20 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0)
 Gecko/20100101 Thunderbird/45.5.1
MIME-Version: 1.0
In-Reply-To: <26EFFF38-A2FF-4BCB-A24D-4FD2D9E5E9EB@visi.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

On 12/5/16 7:09 PM, dennisr@visi.com wrote:
> My preference is to use a network address for this stuff but I was over ruled and needed to use a host specific name or address in the config file. I wanted to use a CNAME in place of the A or PTR records so as in the event we ever have to rebuild a new WAL receiver, I would only need to repoint the CNAME in the DNS system and avoid the possibility of updating a few hundred pg_hba.conf’s with a new IP address or hostname (this is a private cloud environment I am working with so I don’t have a lot of control over hostnames of the nodes they give me or even the networks the node is placed in.)

Note that the IP addresses in pg_hba.conf are not really by themselves a
primary security measure, because the source IP addresses in the same
network are (potentially) under control of the source host.  Their
purpose is rather to allow different classes of hosts to use different
authentication mechanisms.  For example, newer hosts might use SSL,
older hosts passwords.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin