From: Michael Monnerie <michael.monnerie@is.it-management.at>
To: pgsql-admin@postgresql.org
Subject: Re: Postgres security issue - protecting datafiles
Date: Wed, 11 Jun 2008 09:43:04 +0200
Message-ID: <200806110943.04822@zmi.at> (raw)
In-Reply-To: <96f635390806100022o11e0d033v782ff30c56391778@mail.gmail.com>
References: <ce1722a1-ab34-4915-b5db-1915c0dfa5b0@f63g2000hsf.googlegroups.com>
<25650.1212595910@sss.pgh.pa.us>
<96f635390806100022o11e0d033v782ff30c56391778@mail.gmail.com>
On Dienstag, 10. Juni 2008 Zvi Fer wrote:
> I have another solution, which i tried to avoid : my company provides
> file/folder-level encryption . i can apply this encryption with
> specific configuration for the postgres processes . this way - even
> the root cannot access the data, the only one that can access the
> database-files is the owner of the database (which can be the DBA ,
> but can be some1 else as well...)
And where is the decrypt key stored? If you crypt a folder, you need the
key, but root must be able to access the key - or is it hard coded into
software?
mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0660 / 415 65 31 .network.your.ideas.
// PGP Key: "curl -s http://zmi.at/zmi.asc | gpg --import"
// Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4
// Keyserver: www.keyserver.net Key-ID: 1C1209B4
Attachments:
signature.asc (application/pgp-signature, 193B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: michael.monnerie@is.it-management.at
Subject: Re: Postgres security issue - protecting datafiles
In-Reply-To: <200806110943.04822@zmi.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox