From: luis.sa@htip.com.br
To: pgsql-admin@postgresql.org
Subject: Re: Security with V9.3.3 standby servers
Date: Thu, 26 Feb 2015 15:14:47 -0300
Message-ID: <c3c0fdae84022aab03028edbfb111af7@htip.com.br> (raw)
In-Reply-To: <54EF6080.5010806@gmail.com>
References: <54EF46B7.3000809@gmail.com>
<d86bc63267de8ef6177457a6df7ee208@htip.com.br>
<54EF6080.5010806@gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
On Thu, 26 Feb 2015 13:05:52 -0500, John Scalia wrote:
> On 2/26/2015 12:56 PM, luis.sa@htip.com.br wrote:
>> On Thu, 26 Feb 2015 11:15:51 -0500, John Scalia wrote:
>>> Hi all,
>>>
>>> An edict has been handed down here from on high that no script
>>> shall
>>> ever contain any password in cleartext for any reason. Well this is
>>> problem with a streaming replication standby server's recovery.conf
>>> file as the line primary_conninfo = contains said replication
>>> user's
>>> password for that connection. Is there any sort of plan to allow
>>> this
>>> to be md5 or some such encoded? Or what else could I do in this
>>> case?
>>>
>>> Thx,
>>> Jay
>>
>> Yes. Use ssh key to create a fingerprint.
>>
>> Ex. "ssh-keygen" command to generate a fingerprint. And "ssh-copy-id
>> postgres@slave" and "ssh-copy-id user@master" to copy the key to alow
>> both machines communicated over ssh.
>>
> All systems already have ssh keys shared between them as it's used by
> scp to transmit the WAL archive to both standby servers. How would I
> indicate in the recovery.conf that the embedded password in the line
> primary_conninfo is encrypted? That line only has "user=<the user>
> password=<the password>" I was thinking that the "password=" could
> have something like "md5:<the password>" in it. Or you could just
> specify whichever encryption protocol that was used followed by the
> colon.
Sorry, wrong answer. The password is for role user on postgres and not
ssh.
Well, i don't know... but the security may be guaranteed for linux in
permissions (chmod and chown)..
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: luis.sa@htip.com.br
Subject: Re: Security with V9.3.3 standby servers
In-Reply-To: <c3c0fdae84022aab03028edbfb111af7@htip.com.br>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox