pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedPostgres Data Encryption Using LUKS with dm-crypt
6+ messages / 3 participants
[nested] [flat]
* Postgres Data Encryption Using LUKS with dm-crypt
@ 2017-05-16 07:43 rakesh-eltropy <goyal.nitj@gmail.com>
0 siblings, 1 reply; 6+ messages in thread
From: rakesh-eltropy @ 2017-05-16 07:43 UTC (permalink / raw)
To: pgsql-admin
We have encrypted volume using LUKS.
*cryptsetup luksOpen /root/test1 volume1*
and mounted on
*mount /dev/mapper/volume1 /mnt/files*
We created postgres data directory inside /mnt/files and able to start the
postgres database.
*/usr/local/pgsql/bin/pg_ctl -D /mnt/files/postgres/ -l
/var/logs/postgres/postgrs.log start*
Even though we unmounted /mnt/files
*sudo umount -l /mnt/files*
When we try to close volume using LUKS.
*sudo cryptsetup luksClose volume1*
Getting following errors:
*device-mapper: remove ioctl on volume1 failed: Device or resource busy*
--
View this message in context: http://www.postgresql-archive.org/Postgres-Data-Encryption-Using-LUKS-with-dm-crypt-tp5961821.html
Sent from the PostgreSQL - admin mailing list archive at Nabble.com.
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Postgres Data Encryption Using LUKS with dm-crypt
@ 2017-05-16 08:06 Cat <cat@zip.com.au>
parent: rakesh-eltropy <goyal.nitj@gmail.com>
0 siblings, 1 reply; 6+ messages in thread
From: Cat @ 2017-05-16 08:06 UTC (permalink / raw)
To: rakesh-eltropy <goyal.nitj@gmail.com>; +Cc: pgsql-admin
On Tue, May 16, 2017 at 12:43:02AM -0700, rakesh-eltropy wrote:
> */usr/local/pgsql/bin/pg_ctl -D /mnt/files/postgres/ -l
> /var/logs/postgres/postgrs.log start*
> Even though we unmounted /mnt/files
>
> *sudo umount -l /mnt/files*
> When we try to close volume using LUKS.
>
> *sudo cryptsetup luksClose volume1*
> Getting following errors:
>
> *device-mapper: remove ioctl on volume1 failed: Device or resource busy*
Looks fair. You did a lazy unmount whilst postgres is still using it
(lsof -n will confirm) THEN you tried to tell it to stop the encryption
processing, which it wont let you do as the mount is still in use
(though detached from the filesystem tree).
--
"A search of his car uncovered pornography, a homemade sex aid, women's
stockings and a Jack Russell terrier."
- http://www.dailytelegraph.com.au/news/wacky/indeed/story-e6frev20-1111118083480
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Postgres Data Encryption Using LUKS with dm-crypt
@ 2017-05-16 08:12 rakesh goyal <goyal.nitj@gmail.com>
parent: Cat <cat@zip.com.au>
0 siblings, 1 reply; 6+ messages in thread
From: rakesh goyal @ 2017-05-16 08:12 UTC (permalink / raw)
To: Cat <cat@zip.com.au>; +Cc: pgsql-admin
Thanks Cat for quick response. I understand this. Is there any way I can
encrypt the data at rest in Postgres using LUKS. Kind find any
documentation.
On Tue, 16 May 2017 at 1:36 PM, Cat <cat@zip.com.au> wrote:
> On Tue, May 16, 2017 at 12:43:02AM -0700, rakesh-eltropy wrote:
> > */usr/local/pgsql/bin/pg_ctl -D /mnt/files/postgres/ -l
> > /var/logs/postgres/postgrs.log start*
> > Even though we unmounted /mnt/files
> >
> > *sudo umount -l /mnt/files*
> > When we try to close volume using LUKS.
> >
> > *sudo cryptsetup luksClose volume1*
> > Getting following errors:
> >
> > *device-mapper: remove ioctl on volume1 failed: Device or resource busy*
>
> Looks fair. You did a lazy unmount whilst postgres is still using it
> (lsof -n will confirm) THEN you tried to tell it to stop the encryption
> processing, which it wont let you do as the mount is still in use
> (though detached from the filesystem tree).
>
> --
> "A search of his car uncovered pornography, a homemade sex aid, women's
> stockings and a Jack Russell terrier."
> -
> http://www.dailytelegraph.com.au/news/wacky/indeed/story-e6frev20-1111118083480
>
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Postgres Data Encryption Using LUKS with dm-crypt
@ 2017-05-16 12:17 Cat <cat@zip.com.au>
parent: rakesh goyal <goyal.nitj@gmail.com>
0 siblings, 1 reply; 6+ messages in thread
From: Cat @ 2017-05-16 12:17 UTC (permalink / raw)
To: rakesh goyal <goyal.nitj@gmail.com>; +Cc: pgsql-admin
On Tue, May 16, 2017 at 08:12:19AM +0000, rakesh goyal wrote:
> Thanks Cat for quick response. I understand this. Is there any way I can
> encrypt the data at rest in Postgres using LUKS. Kind find any
> documentation.
As near as I can tell, you have.
Why are you trying to unmount the filesystem containing the data and closing
the luks encryption?
--
"A search of his car uncovered pornography, a homemade sex aid, women's
stockings and a Jack Russell terrier."
- http://www.dailytelegraph.com.au/news/wacky/indeed/story-e6frev20-1111118083480
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Postgres Data Encryption Using LUKS with dm-crypt
@ 2017-05-16 12:31 rakesh goyal <goyal.nitj@gmail.com>
parent: Cat <cat@zip.com.au>
0 siblings, 1 reply; 6+ messages in thread
From: rakesh goyal @ 2017-05-16 12:31 UTC (permalink / raw)
To: Cat <cat@zip.com.au>; +Cc: pgsql-admin
I thought there will be a way to close the LUKS encryption volume. Its
clear to me now , encryption volume has to be in the opened state. LUKS
will help if somebody can hold of physical hard disk. It does not protect
against copying data from Live environment.
On Tue, May 16, 2017 at 5:47 PM, Cat <cat@zip.com.au> wrote:
> On Tue, May 16, 2017 at 08:12:19AM +0000, rakesh goyal wrote:
> > Thanks Cat for quick response. I understand this. Is there any way I can
> > encrypt the data at rest in Postgres using LUKS. Kind find any
> > documentation.
>
> As near as I can tell, you have.
>
> Why are you trying to unmount the filesystem containing the data and
> closing
> the luks encryption?
>
> --
> "A search of his car uncovered pornography, a homemade sex aid, women's
> stockings and a Jack Russell terrier."
> - http://www.dailytelegraph.com.au/news/wacky/indeed/story-
> e6frev20-1111118083480
>
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Postgres Data Encryption Using LUKS with dm-crypt
@ 2017-05-16 12:34 Cat <cat@zip.com.au>
parent: rakesh goyal <goyal.nitj@gmail.com>
0 siblings, 0 replies; 6+ messages in thread
From: Cat @ 2017-05-16 12:34 UTC (permalink / raw)
To: rakesh goyal <goyal.nitj@gmail.com>; +Cc: pgsql-admin
On Tue, May 16, 2017 at 06:01:55PM +0530, rakesh goyal wrote:
> I thought there will be a way to close the LUKS encryption volume. Its
> clear to me now , encryption volume has to be in the opened state. LUKS
> will help if somebody can hold of physical hard disk. It does not protect
> against copying data from Live environment.
Correct. The latter is a far more complex problem.
--
"A search of his car uncovered pornography, a homemade sex aid, women's
stockings and a Jack Russell terrier."
- http://www.dailytelegraph.com.au/news/wacky/indeed/story-e6frev20-1111118083480
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2017-05-16 12:34 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2017-05-16 07:43 Postgres Data Encryption Using LUKS with dm-crypt rakesh-eltropy <goyal.nitj@gmail.com>
2017-05-16 08:06 ` Cat <cat@zip.com.au>
2017-05-16 08:12 ` rakesh goyal <goyal.nitj@gmail.com>
2017-05-16 12:17 ` Cat <cat@zip.com.au>
2017-05-16 12:31 ` rakesh goyal <goyal.nitj@gmail.com>
2017-05-16 12:34 ` Cat <cat@zip.com.au>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox