0

I have kind of a naive question, but for the moment it's the only way I found to access a local (I mean, located on the host machine) PostgreSQL database from a docker container, so I'm wondering:

is it considered safe or a good practice to add the public IP -- as given by the interface which is used by the computer to connect to the internet, as shown by ifconfig ; well actually to my router hereunder but the question may be the same when using a VM or a small remote server open to the world -- of a host to the listen_adresses in postgresql.conf file and to add a specific corresponding entry in the pg_hba.conf file?

E.g. with changes as follow in these two configuration files:

postgresql.conf:

listen_addresses = '192.168.xxx.yyy,127.0.0.1'

pg_hba.conf:

host    all             all             192.168.xxx.yyy/32       scram-sha-256
2
  • It is unsafe if you don't take appropriate counter measures, like making sure you have good passwords and that those are needed for logging on, or that your router has a firewall which is working to block incoming traffic.
    – jjanes
    Commented Jan 5, 2022 at 15:29
  • 1
    Note that listen_address is for addresses of network interfaces of your server, whereas in pg_hba.conf you authorize adresses of client hosts. So adding your server address 192.168.xxx.yyy/32 in pg_hba.conf does not allow remote connections, in addition to the fact that all addresses starting with 192.168 are private, anyway. Commented Jan 5, 2022 at 20:10

1 Answer 1

1

Short answer - No.

The Outside World is full of "Ne'er-Do-Wells" that just want to "mess" with anything and everything they kind find to mess with.

This is why Web Servers - like Apache - have so many defensive tools with which to protect themselves against whatever might be thrown at them.
Simply put, Databases - like PostgreSql - just aren't built that way.

This is why most applications you'll see these days are layered, having a client (usually running in a user's web browser), a web server, which can cope with the nefarious "junk" that will get thrown at it and a database, safely nestled away behind protective firewalls and the like and only accessed by trusted connections, such as that from the web server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.