Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Installed PostgreSQL 9.1 x64 on Windows, set up a listen address, but when connecting with pgAdmin I get the following error. Not sure why PostgreSQL is seeing my IPv6 address and not my regular IP address:

enter image description here

To get authentication working, based on the error message, I updated pg_hba.conf with this:

host all all fe80::c5d2:XXXX:XXXX:3bc0/12 trust

That worked, but it's ugly, and too specific. I tried the following based on PostgreSQL docs, but none worked, I get the same 'access denied' error:

local all all trust
host all all 0.0.0.0/12 trust

I got this one working, which covers the entire IPv6 address space, but how can I specify an IPv6 range for more restriction?

host  mydb  myuser  ::/0   trust

Questions

  • Why does pgAdmin pick up my IPv6 address and not my normal IP?
  • How do I specify a range in IPv6 without resorting to ::/0?
share|improve this question

migrated from stackoverflow.com Jun 1 '13 at 7:34

This question came from our site for professional and enthusiast programmers.

add comment

3 Answers 3

up vote 5 down vote accepted

The IPv6 addresses starting with fe80: are link-local addresses. They cannot be routed across different subnets or the internet. They are for communication between machines connected to the same LAN only. The link-local range is defined as fe80::/10. If you trust everybody on your local LAN then you could do

host  all  all  fe80::/10  trust

If you don't trust everybody on your local LAN then you probably want to use username+password protection:

host  all  all  fe80::/10  md5

When specifying md5 you are still using username+password protection, but the password is not transmitted in a readable format anymore. Since you're not trusting people on your local LAN you probably shouldn't send a snoopable password over the wire either.

share|improve this answer
    
fe80 as the prefix worked, thx. What is the significance of /12, /24, etc., on the IPv4 address? –  Raffian Jun 1 '13 at 17:41
    
It is the number of bits that is 'fixed' in the address. So 10.0.0.0/16 would mean that the first 16 bits are fixed and the last 16 bits can be anything. So 10.0.0.0 to 10.0.255.255. 10.0.0.0/24 would be 10.0.0.0 to 10.0.0.255. And 10.0.0.0/18 would be 10.0.0.0 to 10.0.63.255, 10.0.64.0/18 would be 10.0.64.0 to 10.0.127.255, etc. –  Sander Steffann Jun 1 '13 at 22:13
    
And the same goes for IPv6 addresses. fe80::/10 means fe80:0000:0000:0000:0000:0000:0000:0000 to febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff. Google on "CIDR notation" for more info. –  Sander Steffann Jun 1 '13 at 22:16
    
PS: I have no clue what 0.0.0.0/12 is supposed to do. It would be the range 0.0.0.0 to 0.15.255.255, all of which is reserved address space according to iana.org/assignments/ipv4-address-space. Those addresses should never appear in any real connection. –  Sander Steffann Jun 1 '13 at 22:20
add comment

I am not quite sure why pgAdmin has the behavior it does. My recommendation there would be to ask on their support lists and get info on the design of that tool and whether this is a bug or a feature. It may have also to do with Windows name resolution. As a workaround you should be able to specify connecting over the ipv4 address or to 127.0.0.1.

As for the pg_hba.conf question, ipv4 and ipv6 get the different spaces in the file so it doesn't surprise me that you would have to add this.

One option you have, now that you can connect, is to set a password (ALTER USER "username" WITH PASSWORD 'password'). You can then set your entire ipv6 space to md5 in the pg_hba.conf and not have to worry so much. Also if you are on a windows domain, you can use LDAP, SSPI, or Kerberos 5 authentication and thus allow access only to domain members. This is somewhat an advanced topic though.

share|improve this answer
add comment

IPv6 is used because you are connecting to localhost. localhost resolves to both 127.0.0.1 and ::1.

Because operating systems prefer IPv6 over IPv4, that is the reason why IPv6 is used (although on Linux, this can be configured through /etc/gai.conf). The address ::1 is never used as a source address, and you don’t have a global address (2000::/3), which leaves the link-local address (fe80::/10) as the source address.

All perfectly logical, normal, expected behaviour when you think about it.

share|improve this answer
    
If it were logical to me, I wouldn't have asked the question in the first place, lol, but thx for the explanation. –  Raffian Jun 2 '13 at 3:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.