References: <DCB731A2-6896-4669-A6C1-69D5A730829B@gmail.com>
User-agent: mu4e 1.5.8; emacs 27.1.91
From: Tim Cross <theophilusx@gmail.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: How to encrypt password in pgpass file
Date: Wed, 24 Feb 2021 11:27:45 +1100
In-reply-to: <DCB731A2-6896-4669-A6C1-69D5A730829B@gmail.com>
Message-ID: <87eeh6xnyy.fsf@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk


Vipin Madhusoodanan <vipin.madhusoodanan@gmail.com> writes:

> Hi Team,
>
> We have a security requirement to encrypt passwords in .pgpass file. Could you please advise on the options and steps to be followed to achieve this.
>

Basically, don't use .pgpass. I think .pgpass should be viewed as old
legacy solution which is not terribly compatible with today's security
requirements. I don't think there is support for encrypting the .pgpass
file. Even if you could encrypt the .pgpass file, you would then need to
decrypt it with a passpharase anyway (you could have a key which has no
passpharase, but if that is on the same system, what have you achieved
apart from a false sense of security).

How to best solve your requirement depends on the specifics of your
requirement. However, often you can implement something more secure by
using environment variables which are set for the process the psql (or
whatever) command executes in. The value for the variable can be
obtained from a secure source, such as a keyring, ldap server, gpg
encrypted file etc.