pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedSecurity with V9.3.3 standby servers
7+ messages / 5 participants
[nested] [flat]
* Security with V9.3.3 standby servers
@ 2015-02-26 16:15 John Scalia <jayknowsunix@gmail.com>
0 siblings, 5 replies; 7+ messages in thread
From: John Scalia @ 2015-02-26 16:15 UTC (permalink / raw)
To: pgsql-admin
Hi all,
An edict has been handed down here from on high that no script shall ever contain any password in cleartext for any reason. Well this is problem with a streaming replication
standby server's recovery.conf file as the line primary_conninfo = contains said replication user's password for that connection. Is there any sort of plan to allow this to be md5
or some such encoded? Or what else could I do in this case?
Thx,
Jay
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Security with V9.3.3 standby servers
@ 2015-02-26 17:58 luis.sa@htip.com.br
parent: John Scalia <jayknowsunix@gmail.com>
4 siblings, 0 replies; 7+ messages in thread
From: luis.sa@htip.com.br @ 2015-02-26 17:58 UTC (permalink / raw)
To: pgsql-admin
On Thu, 26 Feb 2015 11:15:51 -0500, John Scalia wrote:
> Hi all,
>
> An edict has been handed down here from on high that no script shall
> ever contain any password in cleartext for any reason. Well this is
> problem with a streaming replication standby server's recovery.conf
> file as the line primary_conninfo = contains said replication user's
> password for that connection. Is there any sort of plan to allow this
> to be md5 or some such encoded? Or what else could I do in this case?
>
> Thx,
> Jay
Yes. Use ssh key to create a fingerprint.
Ex. "ssh-keygen" command to generate a fingerprint. And "ssh-copy-id
postgres@slave" and "ssh-copy-id user@master" to copy the key to alow
both machines communicated over ssh.
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Security with V9.3.3 standby servers
@ 2015-02-26 18:14 luis.sa@htip.com.br
parent: John Scalia <jayknowsunix@gmail.com>
4 siblings, 0 replies; 7+ messages in thread
From: luis.sa@htip.com.br @ 2015-02-26 18:14 UTC (permalink / raw)
To: pgsql-admin
On Thu, 26 Feb 2015 13:05:52 -0500, John Scalia wrote:
> On 2/26/2015 12:56 PM, luis.sa@htip.com.br wrote:
>> On Thu, 26 Feb 2015 11:15:51 -0500, John Scalia wrote:
>>> Hi all,
>>>
>>> An edict has been handed down here from on high that no script
>>> shall
>>> ever contain any password in cleartext for any reason. Well this is
>>> problem with a streaming replication standby server's recovery.conf
>>> file as the line primary_conninfo = contains said replication
>>> user's
>>> password for that connection. Is there any sort of plan to allow
>>> this
>>> to be md5 or some such encoded? Or what else could I do in this
>>> case?
>>>
>>> Thx,
>>> Jay
>>
>> Yes. Use ssh key to create a fingerprint.
>>
>> Ex. "ssh-keygen" command to generate a fingerprint. And "ssh-copy-id
>> postgres@slave" and "ssh-copy-id user@master" to copy the key to alow
>> both machines communicated over ssh.
>>
> All systems already have ssh keys shared between them as it's used by
> scp to transmit the WAL archive to both standby servers. How would I
> indicate in the recovery.conf that the embedded password in the line
> primary_conninfo is encrypted? That line only has "user=<the user>
> password=<the password>" I was thinking that the "password=" could
> have something like "md5:<the password>" in it. Or you could just
> specify whichever encryption protocol that was used followed by the
> colon.
Sorry, wrong answer. The password is for role user on postgres and not
ssh.
Well, i don't know... but the security may be guaranteed for linux in
permissions (chmod and chown)..
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Security with V9.3.3 standby servers
@ 2015-02-26 21:57 Scott Ribe <scott_ribe@elevated-dev.com>
parent: John Scalia <jayknowsunix@gmail.com>
4 siblings, 1 reply; 7+ messages in thread
From: Scott Ribe @ 2015-02-26 21:57 UTC (permalink / raw)
To: John Scalia <jayknowsunix@gmail.com>; +Cc: pgsql-admin
On Feb 26, 2015, at 9:15 AM, John Scalia <jayknowsunix@gmail.com> wrote:
>
> An edict has been handed down here from on high that no script shall ever contain any password in cleartext for any reason. Well this is problem with a streaming replication standby server's recovery.conf file as the line primary_conninfo = contains said replication user's password for that connection. Is there any sort of plan to allow this to be md5 or some such encoded? Or what else could I do in this case?
I have replica standbys that are firewalled from the primary. The primary establishes a reverse SSH tunnel to the replica, then the replica is configured as for a local connection on-server at the primary, just using UNIX identity.
--
Scott Ribe
scott_ribe@elevated-dev.com
http://www.elevated-dev.com/
(303) 722-0567 voice
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Security with V9.3.3 standby servers
@ 2015-02-27 02:40 John Scalia <jayknowsunix@gmail.com>
parent: Scott Ribe <scott_ribe@elevated-dev.com>
0 siblings, 0 replies; 7+ messages in thread
From: John Scalia @ 2015-02-27 02:40 UTC (permalink / raw)
To: Scott Ribe <scott_ribe@elevated-dev.com>; +Cc: pgsql-admin
Ahhh, I hadn't considered that. Thanks, I think I'll try that tomorrow morning.
On 2/26/2015 4:57 PM, Scott Ribe wrote:
> On Feb 26, 2015, at 9:15 AM, John Scalia <jayknowsunix@gmail.com> wrote:
>> An edict has been handed down here from on high that no script shall ever contain any password in cleartext for any reason. Well this is problem with a streaming replication standby server's recovery.conf file as the line primary_conninfo = contains said replication user's password for that connection. Is there any sort of plan to allow this to be md5 or some such encoded? Or what else could I do in this case?
> I have replica standbys that are firewalled from the primary. The primary establishes a reverse SSH tunnel to the replica, then the replica is configured as for a local connection on-server at the primary, just using UNIX identity.
>
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Security with V9.3.3 standby servers
@ 2015-02-27 10:33 Albe Laurenz <laurenz.albe@wien.gv.at>
parent: John Scalia <jayknowsunix@gmail.com>
4 siblings, 0 replies; 7+ messages in thread
From: Albe Laurenz @ 2015-02-27 10:33 UTC (permalink / raw)
To: John Scalia *EXTERN* <jayknowsunix@gmail.com>; pgsql-admin
John Scalia wrote:
> An edict has been handed down here from on high that no script shall ever contain any password in
> cleartext for any reason. Well this is problem with a streaming replication
> standby server's recovery.conf file as the line primary_conninfo = contains said replication user's
> password for that connection. Is there any sort of plan to allow this to be md5
> or some such encoded? Or what else could I do in this case?
Well, I would consider "trust" authentication.
If you restrict it to a single IP address, I don't think it is less secure
than having your password lying around on another computer.
Yours,
Laurenz Albe
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Security with V9.3.3 standby servers
@ 2015-02-27 19:02 Peter Eisentraut <peter_e@gmx.net>
parent: John Scalia <jayknowsunix@gmail.com>
4 siblings, 0 replies; 7+ messages in thread
From: Peter Eisentraut @ 2015-02-27 19:02 UTC (permalink / raw)
To: John Scalia <jayknowsunix@gmail.com>; pgsql-admin
On 2/26/15 11:15 AM, John Scalia wrote:
> An edict has been handed down here from on high that no script shall
> ever contain any password in cleartext for any reason. Well this is
> problem with a streaming replication standby server's recovery.conf file
> as the line primary_conninfo = contains said replication user's password
> for that connection. Is there any sort of plan to allow this to be md5
> or some such encoded? Or what else could I do in this case?
You can put the password in the a .pgpass file. Not sure if that counts
as a "script".
Or you can do away with passwords and authenticate using SSL client
certificates.
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2015-02-27 19:02 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2015-02-26 16:15 Security with V9.3.3 standby servers John Scalia <jayknowsunix@gmail.com>
2015-02-26 17:58 ` luis.sa@htip.com.br
2015-02-26 18:14 ` luis.sa@htip.com.br
2015-02-26 21:57 ` Scott Ribe <scott_ribe@elevated-dev.com>
2015-02-27 02:40 ` John Scalia <jayknowsunix@gmail.com>
2015-02-27 10:33 ` Albe Laurenz <laurenz.albe@wien.gv.at>
2015-02-27 19:02 ` Peter Eisentraut <peter_e@gmx.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox