diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2016-04-08 10:45:16 -0400 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2016-04-08 10:48:44 -0400 |
| commit | 2f1d2b7a75fecad25295cb3f453503eb6a176d4f (patch) | |
| tree | 8404aa676cf8aeb71bce8a76c8e554633686b856 /src | |
| parent | 4e55b3f0335c2aa658cd9d1fda4dea2a1f9ab80d (diff) | |
| download | postgresql-2f1d2b7a75fecad25295cb3f453503eb6a176d4f.tar.gz postgresql-2f1d2b7a75fecad25295cb3f453503eb6a176d4f.zip | |
Set PAM_RHOST item for PAM authentication
The PAM_RHOST item is set to the remote IP address or host name and can
be used by PAM modules. A pg_hba.conf option is provided to choose
between IP address and resolved host name.
From: Grzegorz Sampolski <grzsmp@gmail.com>
Reviewed-by: Haribabu Kommi <kommi.haribabu@gmail.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/libpq/auth.c | 23 | ||||
| -rw-r--r-- | src/backend/libpq/hba.c | 9 | ||||
| -rw-r--r-- | src/include/libpq/hba.h | 1 |
3 files changed, 33 insertions, 0 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index f21056e2445..630762cc6b9 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -1739,6 +1739,18 @@ CheckPAMAuth(Port *port, char *user, char *password) { int retval; pam_handle_t *pamh = NULL; + char hostinfo[NI_MAXHOST]; + + retval = pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen, + hostinfo, sizeof(hostinfo), NULL, 0, + port->hba->pam_use_hostname ? 0 : NI_NUMERICHOST | NI_NUMERICSERV); + if (retval != 0) + { + ereport(WARNING, + (errmsg_internal("pg_getnameinfo_all() failed: %s", + gai_strerror(retval)))); + return STATUS_ERROR; + } /* * We can't entirely rely on PAM to pass through appdata --- it appears @@ -1784,6 +1796,17 @@ CheckPAMAuth(Port *port, char *user, char *password) return STATUS_ERROR; } + retval = pam_set_item(pamh, PAM_RHOST, hostinfo); + + if (retval != PAM_SUCCESS) + { + ereport(LOG, + (errmsg("pam_set_item(PAM_RHOST) failed: %s", + pam_strerror(pamh, retval)))); + pam_passwd = NULL; + return STATUS_ERROR; + } + retval = pam_set_item(pamh, PAM_CONV, &pam_passw_conv); if (retval != PAM_SUCCESS) diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c index 28f9fb54ae2..5a397464d75 100644 --- a/src/backend/libpq/hba.c +++ b/src/backend/libpq/hba.c @@ -1447,6 +1447,15 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num) REQUIRE_AUTH_OPTION(uaPAM, "pamservice", "pam"); hbaline->pamservice = pstrdup(val); } + else if (strcmp(name, "pam_use_hostname") == 0) + { + REQUIRE_AUTH_OPTION(uaPAM, "pam_use_hostname", "pam"); + if (strcmp(val, "1") == 0) + hbaline->pam_use_hostname = true; + else + hbaline->pam_use_hostname = false; + + } else if (strcmp(name, "ldapurl") == 0) { #ifdef LDAP_API_FEATURE_X_OPENLDAP diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h index 68a953aa628..b306baf1a56 100644 --- a/src/include/libpq/hba.h +++ b/src/include/libpq/hba.h @@ -64,6 +64,7 @@ typedef struct HbaLine char *usermap; char *pamservice; + bool pam_use_hostname; bool ldaptls; char *ldapserver; int ldapport; |