Re: host name support in pg_hba.conf

* Aidan Van Dyk (aidan(at)highrise(dot)ca) wrote:
> The PTR query is a means to get the "hostname" to check against, so you
> d'nt have to pre-cache all thos possible results of all the hostnames.
> Pre-caching all the hostnames in pg_hba.conf is madness. How long do
> you cache them for? or do send out 1000 queries every connection? You
> can't support wildcards, or anythign usefull...
>
> AFAIK, every software I've used which allows hostnames as some
> connection control all do PTR->A/AAAA lookups as Peter proposed.

Completely agreed. It's madness to precache all thse hostnames, but we
need to figure out the hostname, thus, rDNS is used. The forward lookup
is then to double-check that it matches. This is exactly how Kerberos
works also. You certainly don't want to be repeatedly doing rDNS
lookups to see if maybe that IP has other hosts. I also don't buy that
there's an issue with setting up your rDNS to go to what you put in the
pg_hba and then having the forward of that include the IP; again, it's
how Kerberos works, and even if you don't believe in Kerberos, I hope
you realize it's kind of popular.

Thanks,

Stephen