MIME-Version: 1.0
References: <75b177a0f2627519419009a2134fe050f3f623cb.camel@ageofdream.com>
 <CAMDzVO_HnP+V6bL0myTt0=RRXYLNOfj4XszEKa+LvPSnePO9yg@mail.gmail.com> <36cebb6894294c521aa92a8f1183d8e9dfb2e379.camel@ageofdream.com>
In-Reply-To: <36cebb6894294c521aa92a8f1183d8e9dfb2e379.camel@ageofdream.com>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Tue, 31 Dec 2024 17:32:58 -0700
Message-ID: <CAKFQuwbW_M6Bd5pncjrWRHzpWw1pUr093MAge53zRpayL02LdA@mail.gmail.com>
Subject: Re: Initial Postgres admin account setup using Ansible?
To: Nick <lists2@ageofdream.com>
Cc: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000028aadf062a9a32b3"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwbW_M6Bd5pncjrWRHzpWw1pUr093MAge53zRpayL02LdA%40mail.gmail.com>
Precedence: bulk

--00000000000028aadf062a9a32b3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Dec 31, 2024 at 5:17=E2=80=AFPM Nick <lists2@ageofdream.com> wrote:

>
> ```
> local    all             all             peer map=3Dansible_map
> ```
>
>
> In `pg_ident.conf`, add:
>
> ```
> ansible_map     ansible                 postgres
> ansible_map     postgres                postgres
>
> ```
>
>
> This seems to work, but is it secure? If USER is `all` in
> `pg_hba.conf`, can any POSIX account login?
>
>
The presence of the mapping file reference makes the entry secure in the
sense that only those connection combinations that are explicitly permitted
can happen.  The "all" is automatically restricted to those accounts listed
in the file.  At worst you might get an unwanted failure if, say, you
wanted some other account "alice" to be able to connect to the cluster
using the role "alice".  The "all" would match and use the mapping that
doesn't include "alice".

David J.

--00000000000028aadf062a9a32b3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"fon=
t-family:arial,helvetica,sans-serif"><span style=3D"font-family:Arial,Helve=
tica,sans-serif">On Tue, Dec 31, 2024 at 5:17=E2=80=AFPM Nick &lt;<a href=
=3D"mailto:lists2@ageofdream.com">lists2@ageofdream.com</a>&gt; wrote:</spa=
n></div></div><div class=3D"gmail_quote gmail_quote_container"><blockquote =
class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px sol=
id rgb(204,204,204);padding-left:1ex"><span class=3D"gmail_default" style=
=3D"font-family:arial,helvetica,sans-serif"></span><br>
```<br>
local=C2=A0 =C2=A0 all=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0all=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0peer map=3Dansible_map<br>
```<br>
<br>
<br>
In `pg_ident.conf`, add:<br>
<br>
```<br>
ansible_map=C2=A0 =C2=A0 =C2=A0ansible=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0postgres<br>
ansible_map=C2=A0 =C2=A0 =C2=A0postgres=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 postgres<br>
<br>
```<br><br>
<br>
This seems to work, but is it secure? If USER is `all` in<br>
`pg_hba.conf`, can any POSIX account login?<br><br></blockquote><div><br></=
div><div class=3D"gmail_default" style=3D"font-family:arial,helvetica,sans-=
serif">The presence of the mapping file reference makes the entry secure in=
 the sense that only those connection combinations that are explicitly perm=
itted can happen.=C2=A0 The &quot;all&quot; is automatically restricted to =
those accounts listed in the file.=C2=A0 At worst you might get an unwanted=
 failure if, say, you wanted some other account &quot;alice&quot; to be abl=
e to connect to the cluster using the role &quot;alice&quot;.=C2=A0 The &qu=
ot;all&quot; would match and use the mapping that doesn&#39;t include &quot=
;alice&quot;.</div><div class=3D"gmail_default" style=3D"font-family:arial,=
helvetica,sans-serif"><br></div><div class=3D"gmail_default" style=3D"font-=
family:arial,helvetica,sans-serif">David J.</div><div class=3D"gmail_defaul=
t" style=3D"font-family:arial,helvetica,sans-serif"><br></div></div></div>

--00000000000028aadf062a9a32b3--