Re: Why don't we allow DNS names in pg_hba.conf? - Mailing list pgsql-hackers

From Jon Jensen
Subject Re: Why don't we allow DNS names in pg_hba.conf?
Date
Msg-id Pine.LNX.4.64.0601031247100.20979@ybpnyubfg.ybpnyqbznva
Whole thread Raw
In response to Re: Why don't we allow DNS names in pg_hba.conf?  (Tino Wildenhain <tino@wildenhain.de>)
List pgsql-hackers
On Tue, 3 Jan 2006, Tino Wildenhain wrote:

>>> One thing that bothers me slightly is that we would need to look up each
>>> name (at least until we found a match) for each connection. If you had
>>> lots of names in your pg_hba.conf that could be quite a hit.
>>
>> A possible answer to that is to *not* look up the names from
>> pg_hba.conf, but instead restrict the feature to matching the
>> reverse-DNS name of the client.  This limits the cost to one lookup per
>> connection instead of N (and it'd be essentially free if you have
>> log_hostnames turned on, since we already do that lookup in that case).
>
> Or alternatively (documented) scan and translate the names
> only on restart or sighup. This would limit the overhead
> and changes to the confile-scanner only and would
> at least enable symbolic names in the config files.
> (Of course w/o any wildcards - that would be the drawback)

That's what I suggested yesterday, but others didn't like it and the 
possibility of using /etc/hosts or a name server on the local network to 
mitigate speed concerns makes me think they're right.

Jon

-- 
Jon Jensen
End Point Corporation
http://www.endpoint.com/


pgsql-hackers by date:

Previous
From: Bruce Momjian
Date:
Subject: Re: cvs tip - stats buffer process consuming 100% cpu
Next
From: Tom Lane
Date:
Subject: Re: cvs tip - stats buffer process consuming 100% cpu