diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2016-04-08 10:45:16 -0400 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2016-04-08 10:48:44 -0400 |
| commit | 2f1d2b7a75fecad25295cb3f453503eb6a176d4f (patch) | |
| tree | 8404aa676cf8aeb71bce8a76c8e554633686b856 /doc/src | |
| parent | 4e55b3f0335c2aa658cd9d1fda4dea2a1f9ab80d (diff) | |
Set PAM_RHOST item for PAM authentication
The PAM_RHOST item is set to the remote IP address or host name and can
be used by PAM modules. A pg_hba.conf option is provided to choose
between IP address and resolved host name.
From: Grzegorz Sampolski <grzsmp@gmail.com>
Reviewed-by: Haribabu Kommi <kommi.haribabu@gmail.com>
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/client-auth.sgml | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 3b2935c4f3f..7b204fb48e7 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1617,10 +1617,11 @@ host ... ldap ldapurl="ldap://ldap.example.net/dc=example,dc=net?uid?sub" <literal>password</literal> except that it uses PAM (Pluggable Authentication Modules) as the authentication mechanism. The default PAM service name is <literal>postgresql</literal>. - PAM is used only to validate user name/password pairs. - Therefore the user must already exist in the database before PAM - can be used for authentication. For more information about - PAM, please read the <ulink url="http://www.kernel.org/pub/linux/libs/pam/"> + PAM is used only to validate user name/password pairs and optionally the + connected remote host name or IP address. Therefore the user must already + exist in the database before PAM can be used for authentication. For more + information about PAM, please read the + <ulink url="http://www.kernel.org/pub/linux/libs/pam/"> <productname>Linux-PAM</> Page</ulink>. </para> @@ -1635,6 +1636,20 @@ host ... ldap ldapurl="ldap://ldap.example.net/dc=example,dc=net?uid?sub" </para> </listitem> </varlistentry> + <varlistentry> + <term><literal>pam_use_hostname</literal></term> + <listitem> + <para> + Determines whether the remote IP address or the host name is provided + to PAM modules through the <symbol>PAM_RHOST</symbol> item. By + default, the IP address is used. Set this option to 1 to use the + resolved host name instead. Host name resolution can lead to login + delays. (Most PAM configurations don't use this information, so it is + only necessary to consider this setting if a PAM configuration was + specifically created to make use of it.) + </para> + </listitem> + </varlistentry> </variablelist> </para> |