On Sun, Jan 01, 2006 at 09:03:00PM +0100, Andreas Pflug wrote: > Marc G. Fournier wrote: > > >On Sun, 1 Jan 2006, Tom Lane wrote: > > > >>I was reminded of $subject by > >>http://archives.postgresql.org/pgsql-admin/2006-01/msg00002.php > >> > >>While I haven't tried it, I suspect that allowing a DNS host name > >>would take little work (basically removing the AI_NUMERICHOST flag > >>passed to getaddrinfo in hba.c). There was once a good reason not > >>to allow it: slow DNS lookups would lock up the postmaster. But > >>now that we do this work in an already-forked backend, with an overall > >>timeout that would catch any indefinite blockage, I don't see a good > >>reason why we shouldn't let people use DNS names. > >> > >>Thoughts? > > > > > >Security? > > > I'd bet most pg_hba.conf entries will be (private) networks, not hosts. > Since private networks defined in DNS are probably quite rare, only few > people could benefit. > > Those who *do* define specific host entries, are probably quite security > aware. They might find DNS safe for their purposes, but they'd probably > like a function that shows the resulting hba entries after DNS resolution.
I don't know if the normal DNS libraries allow this, but it would be cool if you could specify that an entry in pg_hba.conf could be looked up from /etc/hosts, but not from generic DNS. AFAIK that would eliminate the possibility of spoofing. -- Jim C. Nasby, Sr. Engineering Consultant [EMAIL PROTECTED] Pervasive Software http://pervasive.com work: 512-231-6117 vcard: http://jim.nasby.net/pervasive.vcf cell: 512-569-9461 ---------------------------(end of broadcast)--------------------------- TIP 5: don't forget to increase your free space map settings
