pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedRestart PostgreSQL service with SSL and private key pass phrase
3+ messages / 3 participants
[nested] [flat]
* Restart PostgreSQL service with SSL and private key pass phrase
@ 2017-11-17 21:19 sri bhav <sri_bhav@hotmail.com>
0 siblings, 2 replies; 3+ messages in thread
From: sri bhav @ 2017-11-17 21:19 UTC (permalink / raw)
To: pgsql-admin
Hi,
I currently have PostgreSQL 9.5 installed on a Windows 10 machine. I have enabled SSL and configured key & crt files with pass phrase. I know that I have to enter the PEM pass phrase everytime I try to restart. So I tried using pg_ctl to start Postgres, but I have few issues:
1. Since I installed Postgres as Windows service, running pg_ctl does not start my service. I see postgresql exe instances running in Task manager but my windows service never gets updated to Running.
2. After running the following command:
pg_ctl -D "c:\Program Files\PostgreSQL\9.5\data" restart -w
I was able to enter the PEM pass phrase since I got a prompt and was able to connect. But when my application is trying to establish the connection with Postgresql, the application is waiting since there are prompts on the command windows where I executed the pg_ctl command to enter the PEM pass phrase. I think this makes the application totally unusable.
1. Per our security requirements, we cannot remove the PEM pass phrase, so how do I control the PostgreSQL service – start & restart with the pass phrase and without user interaction.
Please advise on how to achieve what I am doing or share any alternatives that someone already has for this situation.
Thank you
Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986; for Windows 10
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Restart PostgreSQL service with SSL and private key pass phrase
@ 2017-11-20 13:56 Bear Giles <bgiles@coyotesong.com>
parent: sri bhav <sri_bhav@hotmail.com>
1 sibling, 0 replies; 3+ messages in thread
From: Bear Giles @ 2017-11-20 13:56 UTC (permalink / raw)
To: sri bhav <sri_bhav@hotmail.com>; +Cc: pgsql-admin
I don't have answers for PostgreSQL specifically but servers usually don't
require passphrases on their keys due to the need for human intervention.
The alternative is running a key service - a server on a secure site that
provides keys to servers as they come up - but that just moves the problem
back by one step since you still have to have the authentication
information for the key service on your server. An attacker could still
steal that and obtain the key from the key service.
In the Unix/Linux world one approach is to put the key on an NFS server, or
perhaps even a CD-ROM, and have the server startup script mount the drive,
access the key on it, and then unmount the drive. That keeps the key off
backup media(*) and invisible to the average attacker with illicit root
access. A knowledgeable attacker would still know how to find the startup
script and see how the key is retrieved but they're relatively uncommon.
Needless to say the NFS server would be on an internal network and not
visible to the outside world.
I don't know what's done in the Windows world.
(* the backup software should be smart enough to know that the keys
shouldn't be backed up, e.g., by checking the extended attributes, but it's
easy to misconfigure that.)
On Fri, Nov 17, 2017 at 2:19 PM, sri bhav <sri_bhav@hotmail.com> wrote:
> Hi,
>
> I currently have PostgreSQL 9.5 installed on a Windows 10 machine. I
> have enabled SSL and configured key & crt files with pass phrase. I know
> that I have to enter the PEM pass phrase everytime I try to restart. So I
> tried using pg_ctl to start Postgres, but I have few issues:
>
> 1. Since I installed Postgres as Windows service, running pg_ctl does
> not start my service. I see postgresql exe instances running in Task
> manager but my windows service never gets updated to Running.
> 2. After running the following command:
>
> pg_ctl -D "c:\Program Files\PostgreSQL\9.5\data" restart -w
>
> I was able to enter the PEM pass phrase since I got a prompt and was able
> to connect. But when my application is trying to establish the connection
> with Postgresql, the application is waiting since there are prompts on the
> command windows where I executed the pg_ctl command to enter the PEM pass
> phrase. I think this makes the application totally unusable.
>
> 1. Per our security requirements, we cannot remove the PEM pass
> phrase, so how do I control the PostgreSQL service – start & restart with
> the pass phrase and without user interaction.
>
>
>
> Please advise on how to achieve what I am doing or share any alternatives
> that someone already has for this situation.
>
>
>
> Thank you
>
>
>
>
>
> Sent from Mail <https://go.microsoft.com/fwlink/?LinkId=550986; for
> Windows 10
>
>
>
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Restart PostgreSQL service with SSL and private key pass phrase
@ 2017-11-20 14:12 Laurenz Albe <laurenz.albe@cybertec.at>
parent: sri bhav <sri_bhav@hotmail.com>
1 sibling, 0 replies; 3+ messages in thread
From: Laurenz Albe @ 2017-11-20 14:12 UTC (permalink / raw)
To: sri bhav <sri_bhav@hotmail.com>; pgsql-admin
sri bhav wrote:
> I currently have PostgreSQL 9.5 installed on a Windows 10 machine. I have enabled SSL and configured key & crt files with pass phrase.
> I know that I have to enter the PEM pass phrase everytime I try to restart.
> Since I installed Postgres as Windows service, running pg_ctl does not start my service.
> I see postgresql exe instances running in Task manager but my windows service never gets updated to Running.
> Per our security requirements, we cannot remove the PEM pass phrase, so how do I control the PostgreSQL
> service – start & restart with the pass phrase and without user interaction.
Change the security requirements.
What good is a password on a key if you have to store it on the machine
anyway to allow automatic start of the PostgreSQL server?
Yours,
Laurenz Albe
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2017-11-20 14:12 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2017-11-17 21:19 Restart PostgreSQL service with SSL and private key pass phrase sri bhav <sri_bhav@hotmail.com>
2017-11-20 13:56 ` Bear Giles <bgiles@coyotesong.com>
2017-11-20 14:12 ` Laurenz Albe <laurenz.albe@cybertec.at>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox