pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedPostgres security issue - protecting datafiles
7+ messages / 7 participants
[nested] [flat]
* Postgres security issue - protecting datafiles
@ 2008-06-02 22:16 zferentz@gmail.com
2008-06-04 16:01 ` Re: Postgres security issue - protecting datafiles Jonah H. Harris <jonah.harris@gmail.com>
2008-06-04 16:03 ` Re: Postgres security issue - protecting datafiles Tino Schwarze <postgresql@tisc.de>
2008-06-04 16:09 ` Re: Postgres security issue - protecting datafiles Marcin Kasperski <Marcin.Kasperski@softax.com.pl>
2008-06-04 16:11 ` Re: Postgres security issue - protecting datafiles Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 4 replies; 7+ messages in thread
From: zferentz@gmail.com @ 2008-06-02 22:16 UTC (permalink / raw)
To: pgsql-admin
Hi,
I'd like to use postgres to store my secret data in a way that only
me (the DBA, owner of the table) can access the talbe while the root
(system administrator) who installed and maintains the server - will
not be able to see the data.
Now, I think that "db authentication" is simply not enough , because
the administrator can copy the data files to his own machine (where he
is the owner of the database).
Is there a way to protect the data files, so even the "malicious
administrator" cannot see the data ?
tnx,
zferentz
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Postgres security issue - protecting datafiles
2008-06-02 22:16 Postgres security issue - protecting datafiles zferentz@gmail.com
@ 2008-06-04 16:01 ` Jonah H. Harris <jonah.harris@gmail.com>
3 siblings, 0 replies; 7+ messages in thread
From: Jonah H. Harris @ 2008-06-04 16:01 UTC (permalink / raw)
To: zferentz@gmail.com; +Cc: pgsql-admin
On Mon, Jun 2, 2008 at 6:16 PM, <zferentz@gmail.com> wrote:
> Is there a way to protect the data files, so even the "malicious
> administrator" cannot see the data ?
Encrypt it. Though, how you store the key will be important.
--
Jonah H. Harris, Sr. Software Architect | phone: 732.331.1324
EnterpriseDB Corporation | fax: 732.331.1301
499 Thornall Street, 2nd Floor | jonah.harris@enterprisedb.com
Edison, NJ 08837 | http://www.enterprisedb.com/
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Postgres security issue - protecting datafiles
2008-06-02 22:16 Postgres security issue - protecting datafiles zferentz@gmail.com
@ 2008-06-04 16:03 ` Tino Schwarze <postgresql@tisc.de>
3 siblings, 0 replies; 7+ messages in thread
From: Tino Schwarze @ 2008-06-04 16:03 UTC (permalink / raw)
To: pgsql-admin
On Mon, Jun 02, 2008 at 03:16:54PM -0700, zferentz@gmail.com wrote:
> I'd like to use postgres to store my secret data in a way that only
> me (the DBA, owner of the table) can access the talbe while the root
> (system administrator) who installed and maintains the server - will
> not be able to see the data.
>
> Now, I think that "db authentication" is simply not enough , because
> the administrator can copy the data files to his own machine (where he
> is the owner of the database).
>
> Is there a way to protect the data files, so even the "malicious
> administrator" cannot see the data ?
I suppose, you need to look into SELinux. That might give you the
infrastructure for such purposes, together with an encrypted file
system for DB space.
That's not something you can do via an application. As you already
noticed, anybody with access to the physical table data will be able to
copy it. Of course, you could encrypt the data stored in the table, but
then: where's the key for decryption?
Tino.
--
"What we resist, persists." (Zen saying)
www.craniosacralzentrum.de
www.forteego.de
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Postgres security issue - protecting datafiles
2008-06-02 22:16 Postgres security issue - protecting datafiles zferentz@gmail.com
@ 2008-06-04 16:09 ` Marcin Kasperski <Marcin.Kasperski@softax.com.pl>
3 siblings, 0 replies; 7+ messages in thread
From: Marcin Kasperski @ 2008-06-04 16:09 UTC (permalink / raw)
To: pgsql-admin
> Now, I think that "db authentication" is simply not enough , because
> the administrator can copy the data files to his own machine (where he
> is the owner of the database).
Or just change pg_hba.conf to his taste....
> Is there a way to protect the data files, so even the "malicious
> administrator" cannot see the data ?
Encrypt it. And keep the key on some other machine. And plan your
application so decryption happens on some other machine
--
----------------------------------------------------------------------
| Marcin Kasperski | Communication takes place between people,
| http://mekk.waw.pl | documents are secondary. (Booch)
| |
----------------------------------------------------------------------
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Postgres security issue - protecting datafiles
2008-06-02 22:16 Postgres security issue - protecting datafiles zferentz@gmail.com
@ 2008-06-04 16:11 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-06-10 07:22 ` Re: Postgres security issue - protecting datafiles Zvi Fer <zferentz@gmail.com>
3 siblings, 1 reply; 7+ messages in thread
From: Tom Lane @ 2008-06-04 16:11 UTC (permalink / raw)
To: zferentz@gmail.com; +Cc: pgsql-admin
zferentz@gmail.com writes:
> I'd like to use postgres to store my secret data in a way that only
> me (the DBA, owner of the table) can access the talbe while the root
> (system administrator) who installed and maintains the server - will
> not be able to see the data.
If you think you can hide anything on a machine from its root admin,
I have a bridge I'd like to sell you ...
The only thing you could do along this line is to use the database as a
dumb container for encrypted data that you decrypt only on the client
side, using keys that are never sent to the database server.
Unfortunately that approach loses most of the benefit of using a
database in the first place, since you can hardly do any useful
processing on data that you can't decrypt.
regards, tom lane
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Postgres security issue - protecting datafiles
2008-06-02 22:16 Postgres security issue - protecting datafiles zferentz@gmail.com
2008-06-04 16:11 ` Re: Postgres security issue - protecting datafiles Tom Lane <tgl@sss.pgh.pa.us>
@ 2008-06-10 07:22 ` Zvi Fer <zferentz@gmail.com>
2008-06-11 07:43 ` Re: Postgres security issue - protecting datafiles Michael Monnerie <michael.monnerie@is.it-management.at>
0 siblings, 1 reply; 7+ messages in thread
From: Zvi Fer @ 2008-06-10 07:22 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin
Thnx for the input.
I have another solution, which i tried to avoid : my company provides
file/folder-level encryption . i can apply this encryption with specific
configuration for the postgres processes . this way - even the root cannot
access the data, the only one that can access the database-files is the
owner of the database (which can be the DBA , but can be some1 else as
well...)
I tried to avoid this solution, but now i understand that i don't have any
other choice.
encrypting the data will be useless, because i cannot SELECT by
text/range/dates....
tnx
On Wed, Jun 4, 2008 at 7:11 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> zferentz@gmail.com writes:
> > I'd like to use postgres to store my secret data in a way that only
> > me (the DBA, owner of the table) can access the talbe while the root
> > (system administrator) who installed and maintains the server - will
> > not be able to see the data.
>
> If you think you can hide anything on a machine from its root admin,
> I have a bridge I'd like to sell you ...
>
> The only thing you could do along this line is to use the database as a
> dumb container for encrypted data that you decrypt only on the client
> side, using keys that are never sent to the database server.
> Unfortunately that approach loses most of the benefit of using a
> database in the first place, since you can hardly do any useful
> processing on data that you can't decrypt.
>
> regards, tom lane
>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Postgres security issue - protecting datafiles
2008-06-02 22:16 Postgres security issue - protecting datafiles zferentz@gmail.com
2008-06-04 16:11 ` Re: Postgres security issue - protecting datafiles Tom Lane <tgl@sss.pgh.pa.us>
2008-06-10 07:22 ` Re: Postgres security issue - protecting datafiles Zvi Fer <zferentz@gmail.com>
@ 2008-06-11 07:43 ` Michael Monnerie <michael.monnerie@is.it-management.at>
0 siblings, 0 replies; 7+ messages in thread
From: Michael Monnerie @ 2008-06-11 07:43 UTC (permalink / raw)
To: pgsql-admin
On Dienstag, 10. Juni 2008 Zvi Fer wrote:
> I have another solution, which i tried to avoid : my company provides
> file/folder-level encryption . i can apply this encryption with
> specific configuration for the postgres processes . this way - even
> the root cannot access the data, the only one that can access the
> database-files is the owner of the database (which can be the DBA ,
> but can be some1 else as well...)
And where is the decrypt key stored? If you crypt a folder, you need the
key, but root must be able to access the key - or is it hard coded into
software?
mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0660 / 415 65 31 .network.your.ideas.
// PGP Key: "curl -s http://zmi.at/zmi.asc | gpg --import"
// Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4
// Keyserver: www.keyserver.net Key-ID: 1C1209B4
Attachments:
signature.asc (application/pgp-signature, 193B) download
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2008-06-11 07:43 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2008-06-02 22:16 Postgres security issue - protecting datafiles zferentz@gmail.com
2008-06-04 16:01 ` Jonah H. Harris <jonah.harris@gmail.com>
2008-06-04 16:03 ` Tino Schwarze <postgresql@tisc.de>
2008-06-04 16:09 ` Marcin Kasperski <Marcin.Kasperski@softax.com.pl>
2008-06-04 16:11 ` Tom Lane <tgl@sss.pgh.pa.us>
2008-06-10 07:22 ` Zvi Fer <zferentz@gmail.com>
2008-06-11 07:43 ` Michael Monnerie <michael.monnerie@is.it-management.at>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox