pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedPassword Security
3+ messages / 3 participants
[nested] [flat]
* Password Security
@ 2014-02-04 22:17 CS DBA <cs_dba@consistentstate.com>
0 siblings, 2 replies; 3+ messages in thread
From: CS DBA @ 2014-02-04 22:17 UTC (permalink / raw)
To: pgsql-admin; +Cc: cs_dba@consistentstate.com
Hi All;
We have an application running via a utility that want's clear text
passwords stored in it's config files. I know we can setup ident mapping
but the app doesn't play nice with password prompt requests. We could
set it's connections to trust but it kinda defeats the purpose security
wise.
Any thoughts on best/common practices per connecting to postgres
securely without an interactive password prompt
Thanks in advance
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Password Security
@ 2014-02-05 03:20 Payal Singh <payal@omniti.com>
parent: CS DBA <cs_dba@consistentstate.com>
1 sibling, 0 replies; 3+ messages in thread
From: Payal Singh @ 2014-02-05 03:20 UTC (permalink / raw)
To: CS DBA <cs_dba@consistentstate.com>; +Cc: pgsql-admin
See http://www.postgresql.org/docs/9.1/static/libpq-pgpass.html . I think
the APPDATA portion might be useful in your case
Payal Singh,
Junior Database Administrator,
OmniTI Computer Consulting Inc.
Phone: 240.646.0770 x 253
On Tue, Feb 4, 2014 at 5:17 PM, CS DBA <cs_dba@consistentstate.com> wrote:
> Hi All;
>
> We have an application running via a utility that want's clear text
> passwords stored in it's config files. I know we can setup ident mapping
> but the app doesn't play nice with password prompt requests. We could set
> it's connections to trust but it kinda defeats the purpose security wise.
>
> Any thoughts on best/common practices per connecting to postgres securely
> without an interactive password prompt
>
> Thanks in advance
>
>
>
>
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin
>
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Password Security
@ 2014-02-05 08:36 Albe Laurenz <laurenz.albe@wien.gv.at>
parent: CS DBA <cs_dba@consistentstate.com>
1 sibling, 0 replies; 3+ messages in thread
From: Albe Laurenz @ 2014-02-05 08:36 UTC (permalink / raw)
To: CS DBA *EXTERN* <cs_dba@consistentstate.com>; pgsql-admin
CS DBA wrote:
> We have an application running via a utility that want's clear text
> passwords stored in it's config files. I know we can setup ident mapping
> but the app doesn't play nice with password prompt requests. We could
> set it's connections to trust but it kinda defeats the purpose security
> wise.
>
> Any thoughts on best/common practices per connecting to postgres
> securely without an interactive password prompt
I personally think that having a clear text password stored on the
application server is hardly more secure than allowing trust
authentication for this host.
Essentially you are facing the following conundrum:
A program on a computer should be able to login without human interaction,
but nothing else should.
As far as I know, there is no good solution for this problem.
You can try to hide or obfuscate the password (or other authentication
tokens), but that won't keep a dedicated person logged into the
computer from finding and abusing it.
My opinion is that your best bet is to prevent access to the
computer as much as possible, but not to care too much about how
the computer authenticates with the database.
Yours,
Laurenz Albe
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2014-02-05 08:36 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2014-02-04 22:17 Password Security CS DBA <cs_dba@consistentstate.com>
2014-02-05 03:20 ` Payal Singh <payal@omniti.com>
2014-02-05 08:36 ` Albe Laurenz <laurenz.albe@wien.gv.at>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox