Received: from localhost (unknown [200.46.204.183]) by developer.postgresql.org (Postfix) with ESMTP id 5001B2E0032 for ; Wed, 11 Jun 2008 05:12:43 -0300 (ADT) Received: from developer.postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 40857-05 for ; Wed, 11 Jun 2008 05:12:36 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from mailsrv1.zmi.at (mailsrv1.zmi.at [212.69.162.198]) by developer.postgresql.org (Postfix) with ESMTP id ADBC62E0063 for ; Wed, 11 Jun 2008 05:12:38 -0300 (ADT) Received: from mailsrv.i.zmi.at (h081217054243.dyn.cm.kabsi.at [81.217.54.243]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mailsrv.i.zmi.at", Issuer "mailsrv.i.zmi.at" (not verified)) by mailsrv1.zmi.at (Postfix) with ESMTP id EC880A15 for ; Wed, 11 Jun 2008 09:43:07 +0200 (CEST) Received: from saturn.i.zmi.at (saturn.i.zmi.at [10.0.0.2]) by mailsrv.i.zmi.at (Postfix) with ESMTP id 45BC912543 for ; Wed, 11 Jun 2008 09:43:05 +0200 (CEST) From: Michael Monnerie Organization: it-management http://it-management.at To: pgsql-admin@postgresql.org Subject: Re: Postgres security issue - protecting datafiles Date: Wed, 11 Jun 2008 09:43:04 +0200 User-Agent: KMail/1.9.6 (enterprise 20070904.708012) References: <25650.1212595910@sss.pgh.pa.us> <96f635390806100022o11e0d033v782ff30c56391778@mail.gmail.com> In-Reply-To: <96f635390806100022o11e0d033v782ff30c56391778@mail.gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart15366653.qAolqfP1mB"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200806110943.04822@zmi.at> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200806/102 X-Sequence-Number: 29440 --nextPart15366653.qAolqfP1mB Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Dienstag, 10. Juni 2008 Zvi Fer wrote: > I have another solution, which i tried to avoid : my company provides > file/folder-level encryption . i can apply this encryption with > specific configuration for the postgres processes . this way - even > the root cannot access the data, the only one that can access the > database-files is the owner of the database (which can be the DBA , > but can be some1 else as well...) And where is the decrypt key stored? If you crypt a folder, you need the=20 key, but root must be able to access the key - or is it hard coded into=20 software? mfg zmi =2D-=20 // Michael Monnerie, Ing.BSc ----- http://it-management.at // Tel: 0660 / 415 65 31 .network.your.ideas. // PGP Key: "curl -s http://zmi.at/zmi.asc | gpg --import" // Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4 // Keyserver: www.keyserver.net Key-ID: 1C1209B4 --nextPart15366653.qAolqfP1mB Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) iD8DBQBIT4IIzhSR9xwSCbQRAonrAKCeqL0pghcpp/UKpCiHIv/0mVWn3ACg5dLv +OzcIBk5WDkgwGEtcvB2Aj0= =PU1k -----END PGP SIGNATURE----- --nextPart15366653.qAolqfP1mB--