I'm setting up a new system which contains a postgresql database and I'm trying to lock down which machines are able to open a connection to the database.
I'm trying to use the allow_user_postgresql_connect boolean to achieve this but so far have been unable to get it to block any connections.
I am testing with 2 servers DB and Client as below. Both are RHEL6u2 running postgres 8.4.7-2;
DB# getenforce Enforcing DB# getsebool allow_user_postgresql_connect allow_user_postgresql_connect --> on DB# service postgresql start starting postgresql service: [ OK ] Client# getenforce Enforcing Client# getsebool allow_user_postgresql_connect allow_user_postgresql_connect --> off Client-> psql -h DB "sslmode=require dbname=mydb" postgres connects
I've tried all combinations of allow_user_postgresql_connect on/off on the two machines havent been able to cause it to deny a connection.
How should this bool be set to prevent a user on a machine from connecting to the database?
I'm very new to SElinux so may be overlooking something obvious.