Message-ID: <488CBFB6.6000207@commandprompt.com>
Date: Sun, 27 Jul 2008 11:34:30 -0700
From: "Joshua D. Drake" <jd@commandprompt.com>
Organization: Command Prompt, Inc.
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: Tom Lane <tgl@sss.pgh.pa.us>
CC: Andrew Sullivan <ajs@commandprompt.com>, pgsql-www@postgresql.org
Subject: Re: Insecure DNS servers on PG infrastructure
References: <26210.1216998123@sss.pgh.pa.us>
	<20080725154048.GE29775@commandprompt.com>
	<572.1217018672@sss.pgh.pa.us>
In-Reply-To: <572.1217018672@sss.pgh.pa.us>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Tom Lane wrote:
> Andrew Sullivan <ajs@commandprompt.com> writes:
>> On Fri, Jul 25, 2008 at 11:02:03AM -0400, Tom Lane wrote:
>>> If it says FAIR or POOR then you have an unpatched server or there
>>> is something interfering with the port randomization.  If the server
>>> is behind a NAT firewall then the latter is entirely likely.
> 
>> There's no reason that a NAT should do that, if the device is
>> competently built: if you randomise source ports on the inside, the
>> NAT device could just use the same port on the outside.


Tom can you check if this has been resolved? If not I am going to start 
paging people.

Joshua D. Drake