From: Stephen Frost <sfrost@snowman.net>
To: Pavan Kumar <pavan.dba27@gmail.com>
Cc: David G. Johnston <david.g.johnston@gmail.com>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Cc: pgsql-generallists.postgresql.org <pgsql-general@lists.postgresql.org>
Subject: Re: scram-sha-256 encrypted password in pgpass
Date: Mon, 22 Jun 2020 18:54:37 -0400
Message-ID: <20200622225437.GK3125@tamriel.snowman.net> (raw)
In-Reply-To: <CA+M0sHE=wMp3Q251AaHcz612D14qY7X3xgGvzuM8npAY_B6FxA@mail.gmail.com>
References: <CA+M0sHEJC6whG8VfNk=393uoDsedQg+tVZ9vy7GLdWBZR5BC0A@mail.gmail.com>
<CAKFQuwZHLq1o55-sSaeuF8hU=9nYXN8MNTdL50A7W7Zf_6ZjHQ@mail.gmail.com>
<CA+M0sHE=wMp3Q251AaHcz612D14qY7X3xgGvzuM8npAY_B6FxA@mail.gmail.com>
Greetings,
* Pavan Kumar (pavan.dba27@gmail.com) wrote:
> > What would be the point of storing the encrypted password instead of the
> > plaintext one?
> As per our organization security policies, we can 't keep any passwords in
> plain text format.
Then you need to *actually* encrypt the password in whatever file you'd
like, and then decrypt it using a key from somewhere when you go to
connect to PG and use it to connect to PG.
Anything that doesn't involve some key from somewhere being used to
decrypt it isn't actually meeting your organization's security policies,
certainly not anything that's just dumping whatever into .pgpass and
then allowing you to connect.
> I am working on postgres + pgbouncer setup, tested pgbouncer 1.14 where we
> have support to use encrypted password in userlist,txt file. I am
> surprised why pgpass is not supporting encrypted passwords.
I'm not sure what you mean here, but I'm pretty confident it's not
actually what you think. If you can directly connect with it, without
providing some kind of additional key, then it's, pretty much by
definition, not encrypted.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, pavan.dba27@gmail.com, david.g.johnston@gmail.com, pgsql-admin@lists.postgresql.org, pgsql-general@lists.postgresql.org
Subject: Re: scram-sha-256 encrypted password in pgpass
In-Reply-To: <20200622225437.GK3125@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox