From: Tom Lane <tgl@sss.pgh.pa.us>
To: hubert depesz lubaczewski <depesz@gmail.com>
cc: John Scalia <jayknowsunix@gmail.com>, pgsql-admin@postgresql.org
Subject: Re: Using psql, pg_dump, pg_restore in a script
In-reply-to: 
 <CAKrjmhcfhmcjEp+powf2BMYw9vdWH23O8FPcyokV6QDt2voi2Q@mail.gmail.com>
References: <539F3D20.1060001@gmail.com>
 <CAKrjmhcfhmcjEp+powf2BMYw9vdWH23O8FPcyokV6QDt2voi2Q@mail.gmail.com>
Comments: In-reply-to hubert depesz lubaczewski <depesz@gmail.com>
 message dated "Mon, 16 Jun 2014 21:49:05 +0200"
Date: Mon, 16 Jun 2014 19:33:30 -0400
Message-ID: <25613.1402961610@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

hubert depesz lubaczewski <depesz@gmail.com> writes:
> Giving password as command line option would show it to everybody.

Exactly.

> On the other hand - plaintext file should have privileges set so that
> noone, except for owner of the account from which you're running
> psql/pg_dump/pg_restore, can read it.

> If you prefer, you can set PGPASSWORD environment variable - it will also
> be used by all 3 of these programs (and most other).

Note that environment variables are also unsafe on some platforms, though
(I think) not all.  The .pgpass solution is actually quite the safest one.

			regards, tom lane


-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin