Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from ) id 1YR6Rh-0000Os-Gm for pgsql-admin@arkaria.postgresql.org; Thu, 26 Feb 2015 21:58:13 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.80) (envelope-from ) id 1YR6Rg-0003YB-DG for pgsql-admin@arkaria.postgresql.org; Thu, 26 Feb 2015 21:58:12 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1YR6RY-0003K1-W7 for pgsql-admin@postgresql.org; Thu, 26 Feb 2015 21:58:05 +0000 Received: from mailout.easymail.ca ([64.68.201.169]) by magus.postgresql.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from ) id 1YR6RS-0003yL-9d for pgsql-admin@postgresql.org; Thu, 26 Feb 2015 21:58:01 +0000 Received: from localhost (localhost [127.0.0.1]) by mailout.easymail.ca (Postfix) with ESMTP id F1910E50B; Thu, 26 Feb 2015 16:57:53 -0500 (EST) X-Virus-Scanned: Debian amavisd-new at mailout.easymail.ca X-Spam-Flag: NO X-Spam-Score: -3.909 X-Spam-Level: X-Spam-Status: No, score=-3.909 required=5 tests=[ALL_TRUSTED=-1.8, AWL=-0.202, BAYES_00=-2.599, DNS_FROM_AHBL_RHSBL=0.692] Received: from mailout.easymail.ca ([127.0.0.1]) by localhost (easymail-mailout.easydns.vpn [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jG8dlSusE0dT; Thu, 26 Feb 2015 16:57:53 -0500 (EST) Received: from [192.168.0.18] (c-76-120-51-139.hsd1.co.comcast.net [76.120.51.139]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailout.easymail.ca (Postfix) with ESMTPSA id 1192AE515; Thu, 26 Feb 2015 16:57:53 -0500 (EST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2070.6\)) Subject: Re: Security with V9.3.3 standby servers From: Scott Ribe In-Reply-To: <54EF46B7.3000809@gmail.com> Date: Thu, 26 Feb 2015 14:57:51 -0700 Cc: "pgsql-admin@postgresql.org" Content-Transfer-Encoding: quoted-printable Message-Id: <2645DF43-00E0-4AEB-B02F-DD8AE703528A@elevated-dev.com> References: <54EF46B7.3000809@gmail.com> To: John Scalia X-Mailer: Apple Mail (2.2070.6) X-Pg-Spam-Score: -2.6 (--) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org On Feb 26, 2015, at 9:15 AM, John Scalia wrote: >=20 > An edict has been handed down here from on high that no script shall ever= contain any password in cleartext for any reason. Well this is problem wit= h a streaming replication standby server's recovery.conf file as the line p= rimary_conninfo =3D contains said replication user's password for that conn= ection. Is there any sort of plan to allow this to be md5 or some such enco= ded? Or what else could I do in this case? I have replica standbys that are firewalled from the primary. The primary e= stablishes a reverse SSH tunnel to the replica, then the replica is configu= red as for a local connection on-server at the primary, just using UNIX ide= ntity. --=20 Scott Ribe scott_ribe@elevated-dev.com http://www.elevated-dev.com/ (303) 722-0567 voice --=20 Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-admin