<html><head><base href="x-msg://68/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Yes - anytime you let anyone else connect to your machine it becomes a risk. You have to balance that with the usefulness of an isolated machine vs the value of being able to access it over a network.<div><br></div><div>I guess in this case you are only allowing connections to the database, so that limits the damage that could happen.<br><div><br></div><div><div>In this case, because you are letting anyone from that single ip address connect to any database, you may be pretty safe if you know the owner of that machine - and they are likely to be careful with their password.</div><div><br></div><div>I'd be inclined towards :</div><div><br></div><div>host<span class="Apple-tab-span" style="white-space:pre"> </span>specificdatabase<span class="Apple-tab-span" style="white-space:pre"> </span>individualuser<span class="Apple-tab-span" style="white-space:pre"> </span>machineIP/32<span class="Apple-tab-span" style="white-space:pre"> </span>md5</div><div><br></div><div>and of course you could use hostssl if you were even more worried.</div><div><br></div><div>Then it is a matter of what the individual user can access that becomes your concerns - for example, for most mapserver interfaces we have a 'mapuser' that can only select data from the necessary tables.</div><div><br></div><div>I'm suprised that the fully qualified domain name of the machine is working - the documentation has :</div><div><br></div><div><span class="Apple-style-span" style="font-family: verdana, sans-serif; "><span class="Apple-tab-span" style="white-space:pre"> </span>IP addresses can only be specified numerically, not as domain or host names</span> </div><div><br></div><div>cheers</div><div><br></div><div>Ben</div><div><br></div><div><br></div><div><br></div><div><br><div><div>On 15/02/2012, at 12:46 AM, Bistrais, Bob wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="blue" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div class="Section1" style="page: Section1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; ">Hi Ben,<o:p></o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; "><o:p> </o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; ">I think I’ve had some success, thanks to your input. But please let me know if this is OK…<o:p></o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; "><o:p> </o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; ">I edited pg_hba.conf, adding a line like this:<o:p></o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; ">Host all all mymachinename md5<o:p></o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; "><o:p> </o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; ">-where mymachinename is actually the fully qualified domain name of the machine.<o:p></o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; "><o:p> </o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; ">This works, in the sense that I can now display the data through other than localhost. But is this a good practice? Am I breaching security, or setting myself up for some other disaster? <o:p></o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; "><o:p> </o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; ">Thanks,<o:p></o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; ">Bob <o:p></o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" color="navy" face="Arial"><span style="font-size: 10pt; font-family: Arial; color: navy; "><o:p> </o:p></span></font></div><div><div class="MsoNormal" align="center" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; text-align: center; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><hr size="2" width="100%" align="center" tabindex="-1"></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><b><font size="2" face="Tahoma"><span style="font-size: 10pt; font-family: Tahoma; font-weight: bold; ">From:</span></font></b><font size="2" face="Tahoma"><span style="font-size: 10pt; font-family: Tahoma; "><span class="Apple-converted-space"> </span><a href="mailto:postgis-users-bounces@postgis.refractions.net" style="color: blue; text-decoration: underline; ">postgis-users-bounces@postgis.refractions.net</a><span class="Apple-converted-space"> </span>[mailto:postgis-users-bounces@postgis.refractions.net]<span class="Apple-converted-space"> </span><b><span style="font-weight: bold; ">On Behalf Of<span class="Apple-converted-space"> </span></span></b>Ben Madin<br><b><span style="font-weight: bold; ">Sent:</span></b><span class="Apple-converted-space"> </span>Tuesday, February 14, 2012 10:42 AM<br><b><span style="font-weight: bold; ">To:</span></b><span class="Apple-converted-space"> </span>PostGIS Users Discussion<br><b><span style="font-weight: bold; ">Subject:</span></b><span class="Apple-converted-space"> </span>Re: [postgis-users] setting up or accessing a host</span></font><o:p></o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">Bob,<o:p></o:p></span></font></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">the security is by default tight - but it sounds like you want host based authentication (hba)<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">You will need to read this page a few times :<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><a href="http://www.postgresql.org/docs/9.1/interactive/auth-pg-hba-conf.html" style="color: blue; text-decoration: underline; ">http://www.postgresql.org/docs/9.1/interactive/auth-pg-hba-conf.html</a><o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">and then before you do anything else edit your postgresql.conf file (about 60 lines down) to look like :<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">listen_addresses = '*' # what IP address(es) to listen on;<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "> # comma-separated list of addresses;<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "> # defaults to 'localhost', '*' = all<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "> # (change requires restart)<o:p></o:p></span></font></div></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">Note the * in between the quotes (you may well have localhost there now). <o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">Then edit your pg_hba.conf file.<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">note that you need to restart the server when you change the listen addresses, but you only need to reload it when you edit the pg_hba.conf file<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">Also note that this can be really painful for users with dynamic ip address allocation.<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">good luck.<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">cheers<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">Ben<o:p></o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">On 14/02/2012, at 11:04 PM, Bistrais, Bob wrote:<o:p></o:p></span></font></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><br><br><o:p></o:p></span></font></div><div link="blue" vlink="purple"><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="2" face="Arial"><span style="font-size: 10pt; font-family: Arial; ">So at this point I figured out how to get a PostGIS layer to display through MapServer, but that is only where host=localhost. Now I’m trying to figure out how to access the data from other machines. I’m looking through the documentation but haven’t found out how yet. Can anyone point me in the right direction?<u1:p></u1:p></span></font><o:p></o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; ">_______________________________________________<br>postgis-users mailing list<br><a href="mailto:postgis-users@postgis.refractions.net" style="color: blue; text-decoration: underline; ">postgis-users@postgis.refractions.net</a><br><a href="http://postgis.refractions.net/mailman/listinfo/postgis-users" style="color: blue; text-decoration: underline; ">http://postgis.refractions.net/mailman/listinfo/postgis-users</a><o:p></o:p></span></font></div></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman'; "><font size="3" face="Times New Roman"><span style="font-size: 12pt; "><o:p> </o:p></span></font></div></div></div>_______________________________________________<br>postgis-users mailing list<br><a href="mailto:postgis-users@postgis.refractions.net" style="color: blue; text-decoration: underline; ">postgis-users@postgis.refractions.net</a><br><a href="http://postgis.refractions.net/mailman/listinfo/postgis-users" style="color: blue; text-decoration: underline; ">http://postgis.refractions.net/mailman/listinfo/postgis-users</a><br></div></span></blockquote></div><br></div></div></div></body></html>