Message-ID: <54F0BF55.6020002@gmx.net>
Date: Fri, 27 Feb 2015 14:02:45 -0500
From: Peter Eisentraut <peter_e@gmx.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10;
 rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: John Scalia <jayknowsunix@gmail.com>,
 "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: Security with V9.3.3 standby servers
References: <54EF46B7.3000809@gmail.com>
In-Reply-To: <54EF46B7.3000809@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

On 2/26/15 11:15 AM, John Scalia wrote:
> An edict has been handed down here from on high that no script shall
> ever contain any password in cleartext for any reason. Well this is
> problem with a streaming replication standby server's recovery.conf file
> as the line primary_conninfo = contains said replication user's password
> for that connection. Is there any sort of plan to allow this to be md5
> or some such encoded? Or what else could I do in this case?

You can put the password in the a .pgpass file.  Not sure if that counts
as a "script".

Or you can do away with passwords and authenticate using SSL client
certificates.


-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin