1

I'm setting up a new system which contains a postgresql database and I'm trying to lock down which machines are able to open a connection to the database.

I'm trying to use the allow_user_postgresql_connect boolean to achieve this but so far have been unable to get it to block any connections.

I am testing with 2 servers DB and Client as below. Both are RHEL6u2 running postgres 8.4.7-2;

DB# getenforce
Enforcing
DB# getsebool allow_user_postgresql_connect
allow_user_postgresql_connect --> on
DB# service postgresql start
starting postgresql service:              [  OK  ]

Client# getenforce
Enforcing
Client# getsebool allow_user_postgresql_connect
allow_user_postgresql_connect --> off

Client-> psql -h DB "sslmode=require dbname=mydb" postgres
connects

I've tried all combinations of allow_user_postgresql_connect on/off on the two machines havent been able to cause it to deny a connection.

How should this bool be set to prevent a user on a machine from connecting to the database?

I'm very new to SElinux so may be overlooking something obvious.

Improve this question

1 Answer 1

Reset to default
3

Why are you trying to use SELinux for this? Postgres already has a perfectly cromulent authentication and authorization system, which is what you should be using for this (among other reasons, because it puts failed logins in the logical place: the Postgres logs).

If you are trying to further secure the system by not letting unauthorized systems connect to the Postgres port at all then presumably you have a list of authorized systems (IP addresses), and can configure a firewall rule that blocks traffic from unauthorized hosts.

Trying to wrestle SELinux into submission for something like this seems like trying to drive a square peg into a credit card slot to me.

Improve this answer
7
  • (incidentally from a description of allow_user_postgresql_connect I don't think that flag does what you think it does: It seems to determine if the user can connect to the Postgres port, not whether the Postgres daemon should be accepting connections. Seems essentially worthless to me given the above in any case...)
    – voretaq7
    Nov 8, 2012 at 23:48
  • 1
    Yeah, the boolean permits processes running in the user domain on the DB server to connect to the socket.
    – steelcityamir
    Nov 9, 2012 at 0:00
  • 1
    @TaninDirect Correct -- the boolean only affects the machine it's set on. It's useful for enforcing a site policy ("this machine should never even attempt to connect to Postgres"), though such policy is properly enforced on the server as I described above. It might also briefly inconvenience someone who has broken into the local machine, but at that point they can just copy the $PGDATA directory and they've got your DB anyway...
    – voretaq7
    Nov 9, 2012 at 0:09
  • 1
    +1 for cromulent usage of the word cromulent.
    – HopelessN00b
    Nov 9, 2012 at 0:19
  • 1
    For anyone stumbling across this in the future, go with the original answer and be happy with other metods of securing the DB. I haven't been able to get this working even for local accounts on the DB server.
    – TaninDirect
    Nov 9, 2012 at 1:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .