Date: Mon, 22 Jun 2020 18:54:37 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Pavan Kumar <pavan.dba27@gmail.com>
Cc: "David G. Johnston" <david.g.johnston@gmail.com>,
	Pgsql-admin <pgsql-admin@lists.postgresql.org>,
	"pgsql-generallists.postgresql.org" <pgsql-general@lists.postgresql.org>
Subject: Re: scram-sha-256 encrypted password in pgpass
Message-ID: <20200622225437.GK3125@tamriel.snowman.net>
References: 
 <CA+M0sHEJC6whG8VfNk=393uoDsedQg+tVZ9vy7GLdWBZR5BC0A@mail.gmail.com>
 <CAKFQuwZHLq1o55-sSaeuF8hU=9nYXN8MNTdL50A7W7Zf_6ZjHQ@mail.gmail.com>
 <CA+M0sHE=wMp3Q251AaHcz612D14qY7X3xgGvzuM8npAY_B6FxA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="4ybNbZnZ8tziJ7D6"
Content-Disposition: inline
In-Reply-To: 
 <CA+M0sHE=wMp3Q251AaHcz612D14qY7X3xgGvzuM8npAY_B6FxA@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--4ybNbZnZ8tziJ7D6
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Greetings,

* Pavan Kumar (pavan.dba27@gmail.com) wrote:
> > What would be the point of storing the encrypted password instead of the
> > plaintext one?
> As per our organization security policies, we can 't keep any  passwords in
> plain text format.

Then you need to *actually* encrypt the password in whatever file you'd
like, and then decrypt it using a key from somewhere when you go to
connect to PG and use it to connect to PG.

Anything that doesn't involve some key from somewhere being used to
decrypt it isn't actually meeting your organization's security policies,
certainly not anything that's just dumping whatever into .pgpass and
then allowing you to connect.

> I am working on postgres + pgbouncer setup, tested pgbouncer 1.14 where we
> have support to use encrypted password in userlist,txt file. I am
> surprised why  pgpass is not supporting encrypted passwords.

I'm not sure what you mean here, but I'm pretty confident it's not
actually what you think.  If you can directly connect with it, without
providing some kind of additional key, then it's, pretty much by
definition, not encrypted.

Thanks,

Stephen

--4ybNbZnZ8tziJ7D6
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJe8TasAAoJEO1sijiDR2RVFfkP/2ZNvp+zZjMKFAcGZNYN3lSA
3A72nycjdpRWkkHFWQeyYjuxYa2vwZtfjCl6CXv0gokcfQjvdj7Mk/Bt13B75dk2
FlwSOJnHkf38hNrBhal9XgQlQ5/1RnL25Wszy6BZoRJUa53O6NNDSgMaPJmt9nht
7n+UQVkStp0PjHHHB42qpT0PMpY1HbQ832LPOD5Y1Pe83Qa16cnILGsSRpGoRzIT
zEQ+EUrDLiuSYwdw3gVIQ5g+PvHP5oJu/Hb3Lm9swY6xpoMZezFafaNtWIxL15wB
xvDAmWhRE46YtAAb18M+qwBzIl/owBYi123kAwmouQwBNaDgfxW7iis45ixVA6d/
HiSZ3KdImy00QkwJFEZn/J9qYKAwWePO7hdKhhVP4acGBUTyzy9TJFV3O35T/OnA
KIcw23tYzCkERKGqMqbmdgrBMrFnNAeABRZN7yf+9VUgDbEb/74tYjm3QRT8Gi7L
yCDHkx/Zu9KU9OIoEMjIb5UsO/noR1/1a1IE5enYE5erLW2caazxgbovKCdA7GNj
tZMPjDhbT8RyhKRIKG5Ki2kgQ+dxCGmYf4MD0RcuZocCEWspKXNgrUUKJTz9rHAT
bZm1zTEHwxb/l2YQwAA+V4pHDaivw6OPfrBWmrAebufjs6BeOuKi81/iQuSkfI/V
RDvwGo166J7klWVfyxvu
=SMtn
-----END PGP SIGNATURE-----

--4ybNbZnZ8tziJ7D6--