Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1i8XTx-0004yi-Of for pgsql-admin@arkaria.postgresql.org; Thu, 12 Sep 2019 22:22:29 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1i8XTv-0002vP-IJ for pgsql-admin@arkaria.postgresql.org; Thu, 12 Sep 2019 22:22:27 +0000 Received: from magus.postgresql.org ([87.238.57.229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1i8XTv-0002vC-60 for pgsql-admin@lists.postgresql.org; Thu, 12 Sep 2019 22:22:27 +0000 Received: from mail-ot1-x341.google.com ([2607:f8b0:4864:20::341]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1i8XTq-00024o-Kl for pgsql-admin@lists.postgresql.org; Thu, 12 Sep 2019 22:22:26 +0000 Received: by mail-ot1-x341.google.com with SMTP id 21so27599822otj.11 for ; Thu, 12 Sep 2019 15:22:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language; bh=AyMUAp33IcjAvYboIHF6LTGh37DJpVn+oSpgwFPZgOk=; b=tSoVLiuCvoZTCpB88I/hCPxXDFUKcZi7LLX+bZQZtN3idf9lzOMvBLXKxhifljCg3H rsLcIriLt9kx8E3eafXqS5+tSVaY1rxN3525hXGI7wof5wFht+g3ns72n2vyNHpSyWFY 1IVjY+1vKaiOSPYEbfKwV5an7oOQBGbCRzN81W9w3+C+hzUb+Tg+mx2sg4FnoQDhyoDt tfintrz6cw1KvwAHdo6HZVRbANbemSoujbpHpzh4R8wGlB7L3EvquGY8uI9zgi48dHvu B2A4ye3k2eafJ4GzimR4uhcZo4PgJWlRMOVi9CvL5bp5t8PzowystcRDVQHPFFgW/P9i dHbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=AyMUAp33IcjAvYboIHF6LTGh37DJpVn+oSpgwFPZgOk=; b=O2OkGNdTsSZSWlDIQiuyfTO9MtncR7eslBK9tLvLM65WudrK6nAlUKoiIL1wDL/PFR 4IJeT73BcDW/nkXYJTEw3W9P6ilwvinW2EHum7isnNfK/f3eVrowDIuL1rCeO57c6+4G kJ9YhsOKdtUD1+HgjGYyxeWEdlkm+LHKzdIBeMOra1DbnvXYsqFVncTuiCnXtLB/1K6+ uNDkb/A+V2vk9BLZf7YzUq1UE+tCbGFwZ4LzTj+EPMQRNg7GL7w4Kzr9WYbuX2Q1qdU6 tLgrUjCHCYKdmo/xWhNWrHWPa43g611f9AcJoPL5n0bZFcGAku+OMBMhgI45UWTfVA8b KmUw== X-Gm-Message-State: APjAAAWVrAU+JBFjF8PnonoNoyycZwUfVs3PKxXG8xs9iBbFAa0eAFyA pBT4t38JzDOzEFqEPbhfUpeUEcxKjCnc5g== X-Google-Smtp-Source: APXvYqwMx2ks9dDWe05BEj9IswKgtn1Pdg8M2SBjbM2YiCeq3jHi5cXopihC746EkfIdcrYLIwBpdg== X-Received: by 2002:a9d:6250:: with SMTP id i16mr36985716otk.213.1568326940419; Thu, 12 Sep 2019 15:22:20 -0700 (PDT) Received: from [192.168.1.10] (ip70-186-126-197.no.no.cox.net. [70.186.126.197]) by smtp.googlemail.com with ESMTPSA id y6sm269190oiy.45.2019.09.12.15.22.18 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 12 Sep 2019 15:22:19 -0700 (PDT) Subject: Re: Reg: Filesystem level encryption support for postgreSQL To: pgsql-admin@lists.postgresql.org References: <6962f5a2-b7e9-4a12-9991-b786515ffc83@DM6NAM12FT031.eop-nam12.prod.protection.outlook.com> From: Ron Message-ID: Date: Thu, 12 Sep 2019 17:22:18 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------303783CA5553BADB7D720822" Content-Language: en-US List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk This is a multi-part message in MIME format. --------------303783CA5553BADB7D720822 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit But you said "i need to implement *Filesystem* level encryption".  That's not specific to PostgreSQL. On 9/12/19 4:57 PM, pradeep pandey wrote: > Thanks but i am looking for solution which is more specific to postgreSQL > in line with TDE and HSM > > ---------------------------------------------------------------------------- > *From:* jwiencek3 > *Sent:* Thursday, September 12, 2019 9:42 PM > *To:* pradeep pandey ; > pgsql-admin@lists.postgresql.org > *Subject:* Re: Reg: Filesystem level encryption support for postgreSQL > I'm working on an environment that is using Hytrust.   Other than taking a > long time encrypt the disk there have been no issues at all. > > FYI encryption of a 1Tb mount takes approx. 12 hours.  We had to decrypt > at one point and that effort was about the same as an encrypt. > > Storage admins owned this not the DBA. > > > Sent via the Samsung Galaxy S9+, an AT&T 5G Evolution capable smartphone > > -------- Original message -------- > From: pradeep pandey > Date: 9/12/19 3:59 PM (GMT-06:00) > To: pgsql-admin@lists.postgresql.org > Subject: Reg: Filesystem level encryption support for postgreSQL > > Hi folks, > > i am new to postgreSQL and i need to implement Filesystem level > encryption  and we use EKM for encryption keys > i am seeking you folks help to know 2 things here > > * if i implment EKM which is third party encryption is that supported by > postgreSQL > * what is the best practice and supported method of implmenting the > filesytem level of encyption/protection in postgreSQL > * i searched google but did not find much info > * any pointer or link to read would alos help > > Thanks in advance folks > Pradeep > -- Angular momentum makes the world go 'round. --------------303783CA5553BADB7D720822 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit But you said "i need to implement Filesystem level encryption".  That's not specific to PostgreSQL.

On 9/12/19 4:57 PM, pradeep pandey wrote:
Thanks but i am looking for solution which is more specific to postgreSQL in line with TDE and HSM 

From: jwiencek3 <jwiencek3@comcast.net>
Sent: Thursday, September 12, 2019 9:42 PM
To: pradeep pandey <pandeyp@hotmail.com>; pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Re: Reg: Filesystem level encryption support for postgreSQL
 
I'm working on an environment that is using Hytrust.   Other than taking a long time encrypt the disk there have been no issues at all.

FYI encryption of a 1Tb mount takes approx. 12 hours.  We had to decrypt at one point and that effort was about the same as an encrypt. 

Storage admins owned this not the DBA.


Sent via the Samsung Galaxy S9+, an AT&T 5G Evolution capable smartphone

-------- Original message --------
From: pradeep pandey <pandeyp@hotmail.com>
Date: 9/12/19 3:59 PM (GMT-06:00)
Subject: Reg: Filesystem level encryption support for postgreSQL

Hi folks, 

i am new to postgreSQL and i need to implement Filesystem level encryption  and we use EKM for encryption keys
i am seeking you folks help to know 2 things here 
  • if i implment EKM which is third party encryption is that supported by postgreSQL 
  • what is the best practice and supported method of implmenting the filesytem level of encyption/protection in postgreSQL 
  • i searched google but did not find much info 
  • any pointer or link to read would alos help 
Thanks in advance folks 
Pradeep
 


--
Angular momentum makes the world go 'round.
--------------303783CA5553BADB7D720822--