On Wed, 2006-12-27 at 17:02 -0500, Stephen Frost wrote:
> * Joshua D. Drake ([EMAIL PROTECTED]) wrote:
> > On Wed, 2006-12-27 at 16:41 -0500, Stephen Frost wrote:
> > > I'm inclined towards doing the reverse-DNS of the connecting IP and then
> > > checking that the forward of that matches.
> > 
> > Hmm what if it doesn't? Which is the case any many scenario. My thoughts
> > are:
> If it doesn't then it's not allowed, of course. :)
> > If www.commandprompt.com is allowed, then the ip address
> > is allowed to connect. 
> > 
> > If we go the reverse way: 
> > 
> >    name = 129.commandprompt.com.
> > 
> > Which really isn't that useful imo.
> While I agree that the way your reverse DNS has been done isn't very
> useful, I don't feel that such a setup should be encouraged or
> accomedated by an authorization system.  

Well from the lazy hat of sysadmin. The *only* reason I even have
reverse dns is to deal with smtp servers that won't accept email unless
the ip has a reverse ;)

> There's a couple of reasons
> to go with reverse DNS:
> #1: www.commandprompt.com could legitimately map to multiple IP
> addresses

Agreed, I was thinking about that. The only thing I could come up with
is a list that would be checked (think where foo IN ())

> #2: You may not be able to see all the addresses it maps to at a given
> time without a bunch of work (potentially requiring multiple look-ups)

Hmm... I would have to check that.

> #4: Even in the case mentioned, 129.commandprompt.com does resolve back
> to the appropriate IP, so the re-check would succeed (but you'd have to
> put 129.commandprompt.com into pg_hba, or change it to 'www129' and put
> 'www*' in)

My proposal does not accept that syntax. I think www* would be insane.

> > syntaxes that are available :)
> Sure.  Either way for this is alright with me, really.  Just be sure to
> document it clearly whichever way you decide to go. :)

Like the stone tablets of God.

Joshua D. Drake

>       Thanks,
>               Stephen

      === The PostgreSQL Company: Command Prompt, Inc. ===
Sales/Support: +1.503.667.4564 || 24x7/Emergency: +1.800.492.2240
Providing the most comprehensive  PostgreSQL solutions since 1997

Donate to the PostgreSQL Project: http://www.postgresql.org/about/donate

---------------------------(end of broadcast)---------------------------
TIP 6: explain analyze is your friend

Reply via email to