From: Alvaro Herrera <alvherre@2ndquadrant.com>
To: Tim Cross <theophilusx@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: scram-sha-256 encrypted password in pgpass
Date: Mon, 22 Jun 2020 21:53:06 -0400
Message-ID: <20200623015306.GA12369@alvherre.pgsql> (raw)
In-Reply-To: <87mu4ud3vj.fsf@gmail.com>
On 2020-Jun-23, Tim Cross wrote:
> If you need to use a password in a command line scenario (i.e. with a
> script), then one way to get around the issue of not storing plain text
> passwords is to use GPG. The basic model is
>
> - Create a GPG key and store it in a secure place, such as a keystore
> - Use that GPG key to encrypt your password in a file e.g. my-secret.gpg
> - In your script, you can have something like
>
> PWD = `gpg -q --for-your-eyes-only --no-tty -d ~/.secure/my-secret.gpg`
Perhaps the way to implement this is to have .pgpass be a named pipe,
and you have a program that produces lines from encrypted input after
requesting a passphrase from the user -- perhaps using gpg underneath.
I have vague recollections of this being discussed in the past.
For example, see this thread from 2013
https://www.postgresql.org/message-id/CAAZKuFaJUfdDFp1_vGHbDfYRu0Sj6mSOVvKRp87aCQ53ov6iwA@mail.gmail...
--
Álvaro Herrera https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: alvherre@2ndquadrant.com, theophilusx@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: scram-sha-256 encrypted password in pgpass
In-Reply-To: <20200623015306.GA12369@alvherre.pgsql>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox