1

I have a pgsql9.4 server running on centos with a pg_hba.conf to accept md5 connections from a certain range of IPs. With IPs redacted, my pg_hba.conf file looks like the following:

# TYPE  DATABASE        USER            ADDRESS                 METHOD

# "local" is for Unix domain socket connections only
local   all             all                                     ident
# IPv4 local connections:
host    all             all             127.0.0.1/32            ident
# IPv6 local connections:
host    all             all             ::1/128                 ident
# Allow replication connections from localhost, by a user with the
# replication privilege.
#local   replication     postgres                                peer
#host    replication     postgres        127.0.0.1/32            ident
#host    replication     postgres        ::1/128                 ident
#local  #DBNAME#         #USERNAME#                               md5     
#host   #DBNAME#         #USERNAME#       ###.###.###.0/24          md5

This configuration works great for IPs in the range of xxx.xx.xx.0 through xxx.xx.xx.24. However, when I try to increase it to accommodate access from a server on a higher IP number (112) and try to restart the postgres service, the service fails on restart.

I tried creeping the number up from 0/25 and made it up to a number which runs our puppet server.

I also tried adding a second, identical record to encompass just the IP range 111/112 but to no avail.

Anyone have any ideas as to why Postgres might consider these to be an invalid pg_hba.conf?

EDIT: Forgot to mention that listen_addresses is set to '*' so that access can be controlled user-by-user inside of pg_hba.conf

2

That host information is the CIDR notation, when you use 172.16.33.0/24 you are not giving the range from 0 to 24, you are, in fact, giving the range from 172.16.33.1 to 172.16.33.254 (read CIDR blocks to understand better why). ipcalc tool can help you identify that:

$ ipcalc 172.16.33.0/24
Network:    172.16.33.0/24
Address space:  Private Use
Address class:  Class B
Netmask:    255.255.255.0 = 24
Broadcast:  172.16.33.255

HostMin:    172.16.33.1
HostMax:    172.16.33.254
Hosts/Net:  254

So, 172.16.33.0/24 already includes 172.16.33.111` and172.16.33.112, meaning you don't need to do anything else inpg_hba.confbut add the line with172.16.33.0/24`.

0

So it appears as though I was misunderstanding the syntax of the pg_hba.conf file. That 0/24 is not a range of IP addresses.

Examining the postgres logs gave me an error message of invalid CIDR mask in address "###.##.##.111/112" which alerted me to the existence and usage of CIDR notation.

I resolved the error by adding records for each IP that I wanted to accommodate, alongside a /32 to each of them

91 host    DBNAME         USERNAME        172.16.33.111/32        md5
92 host    DBNAME         USERNAME        172.16.33.112/32        md5
93 host    DBNAME         USERNAME        172.16.33.0/24          md5

This seems to work great. Now I just need to brush up my understanding of the different notations used in pg_hba.conf :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.