Subject: Re: Delays between "connection received" and "connection authenticated" because of localhost entries in hba

From: Vijaykumar Jain <[email-masked]>
Date: Wed, 30 Oct 2024 00:15:47 +0530

On Wed, 30 Oct 2024 at 00:04, Alan Hodgson <[email-masked]> wrote:

> On Tue, 2024-10-29 at 16:30 +0000, Daniel Westermann (DWE) wrote:
>
> Delays between "connection received" and "connection authenticated"
> because of localhost entries in hba
>
>
> Maybe check that "files" is the first mechanism for hosts lookups in
> nsswitch.conf.
>
> afaik dig doesn't follow the same name resolution path as glibc.
>

a connection received should mean resolution was done, right ? am i missing
something?
I could try adding delay with traffic control, but then if a connection
established is logged in the log, then name resolution is ok ?

or the syscall to md5 is slow , does it work faster for trust ? just saying
:)

-- 
Thanks,
Vijay

Open to work
Resume - Vijaykumar Jain <https://github.com/cabecada>

---

From: Alan Hodgson <[email-masked]>
Date: Tue, 29 Oct 2024 12:10:07 -0700

On Wed, 2024-10-30 at 00:15 +0530, Vijaykumar Jain wrote:
> > > Delays between "connection received" and "connection
> > > authenticated" because of localhost entries in hba
> > 
> > 
> > Maybe check that "files" is the first mechanism for hosts lookups
> > in nsswitch.conf.
> > 
> a connection received should mean resolution was done, right ? am
> i missing something?

Well, I'm just throwing out something to check, but I meant on the
server, not the client. It's trying to resolve "localhost" to check
the auth. If there's a delay, that's probably where it is.

I guess I just assumed that's where you were testing dig.

---

From: "Daniel Westermann (DWE)" <[email-masked]>
Date: Tue, 29 Oct 2024 20:00:47 +0000

>>Maybe check that "files" is the first mechanism for hosts lookups in nsswitch.conf.

>afaik dig doesn't follow the same name resolution path as glibc.

I don't know. Is there a way to test the glibc way easily?

> a connection received should mean resolution was done, right ? am i missing something?

>Well, I'm just throwing out something to check, but I meant on the server, not the client. It's trying to resolve >"localhost" to check the auth. If there's a delay, that's probably where it is.

>I guess I just assumed that's where you were testing dig.

Yes

Regards
Daniel