Re: Blocking clients based on application name?

Jeff Janes <[email protected]> Sun, 1 Sep 2019 12:58:15 -0400

Newsgroups	gmane.comp.db.postgresql.admin
Message-ID	<CAMkU=1xusATj_awJsTaHuWVW0Fp1+Zy14NQ62oRuQCJndyDxYQ@mail.gmail.com>

On Thu, Aug 29, 2019 at 1:49 PM Wells Oliver <[email protected]> wrote:

> Seems silly, but can you block clients based on the application name? i.e.
> if you wanted to block anyone trying to connect with PG Admin III...
>

There is an authentication hook you can use to do that, if you are willing
to compile some C code and install the .so file.

It isn't going to be very robust, because there are different ways to set
the application_name.  But it works for the way pgAdmin3 sets it.

This is heavily based on auth_delay (
https://www.postgresql.org/docs/current/auth-delay.html).

Cheers,

Jeff

>

auth_deny.c (application/octet-stream, 1.2 KB)

/* -------------------------------------------------------------------------
 *
 * auth_delay.c
 *
 * Copyright (c) 2010-2019, PostgreSQL Global Development Group
 *
 * IDENTIFICATION
 *		contrib/auth_delay/auth_delay.c
 *
 * -------------------------------------------------------------------------
 */
#include "postgres.h"

#include <limits.h>

#include "libpq/auth.h"
#include "port.h"
#include "utils/guc.h"
#include "utils/timestamp.h"

PG_MODULE_MAGIC;

void		_PG_init(void);
/* Original Hook */
static ClientAuthentication_hook_type original_client_auth_hook = NULL;

/*
 * Check authentication
 */
static void
auth_deny_checks(Port *port, int status)
{
	/*
	 * Any other plugins which use ClientAuthentication_hook.
	 */
	if (original_client_auth_hook)
		original_client_auth_hook(port, status);

	if (status != STATUS_OK)
		return;

	/*
	 * error if not allowed
	 */
	if (port->application_name && strcmp("pgAdmin III - Browser",port->application_name)==0)
		ereport(FATAL,
				(errcode(ERRCODE_INTERNAL_ERROR),
				 errmsg("I don' like '%s'", port->application_name)));
}

/*
 * Module Load Callback
 */
void
_PG_init(void)
{
	/* Install Hooks */
	original_client_auth_hook = ClientAuthentication_hook;
	ClientAuthentication_hook = auth_deny_checks;
}

Makefile (application/octet-stream, 317 B) - not displayed