Received: from malur.postgresql.org ([217.196.149.56])
 by arkaria.postgresql.org with esmtp (Exim 4.80) (envelope-from
 <pgsql-admin-owner+M43523=pgsql+2Dadmin=arkaria.postgresql.org@postgresql.org>)
 id 1YR2xa-0000Gn-Mw
 for pgsql-admin@arkaria.postgresql.org; Thu, 26 Feb 2015 18:14:54 +0000
Received: from localhost ([127.0.0.1] helo=postgresql.org)
 by malur.postgresql.org with smtp (Exim 4.80) (envelope-from
 <pgsql-admin-owner+M43523=pgsql+2Dadmin=arkaria.postgresql.org@postgresql.org>)
 id 1YR2xa-00034G-6R
 for pgsql-admin@arkaria.postgresql.org; Thu, 26 Feb 2015 18:14:54 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
 by malur.postgresql.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256)
 (Exim 4.80) (envelope-from <luis.sa@htip.com.br>) id 1YR2xZ-00034A-FZ
 for pgsql-admin@postgresql.org; Thu, 26 Feb 2015 18:14:53 +0000
Received: from mx.htip.com.br ([200.143.182.12] helo=mail.htip.com.br)
 by magus.postgresql.org with esmtp (Exim 4.80)
 (envelope-from <luis.sa@htip.com.br>) id 1YR2xV-0008Dp-S9
 for pgsql-admin@postgresql.org; Thu, 26 Feb 2015 18:14:52 +0000
Received: from localhost (localhost [127.0.0.1])
 by mail.htip.com.br (Postfix) with ESMTP id E7CE350A85D
 for <pgsql-admin@postgresql.org>; Thu, 26 Feb 2015 15:14:47 -0300 (BRT)
X-Virus-Scanned: by amavisd-new-2.6.4 (20090625) (Debian) at htip.com.br
Received: from mail.htip.com.br ([127.0.0.1])
 by localhost (mail.htip.com.br [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id einsW4syoGbK for <pgsql-admin@postgresql.org>;
 Thu, 26 Feb 2015 15:14:47 -0300 (BRT)
Received: from www.htip.com.br (localhost [127.0.0.1])
 by mail.htip.com.br (Postfix) with ESMTP id B9B9250A68D
 for <pgsql-admin@postgresql.org>; Thu, 26 Feb 2015 15:14:47 -0300 (BRT)
MIME-Version: 1.0
Content-Type: text/plain;
 charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 7bit
Date: Thu, 26 Feb 2015 15:14:47 -0300
From: luis.sa@htip.com.br
To: <pgsql-admin@postgresql.org>
Subject: Re: Security with V9.3.3 standby servers
In-Reply-To: <54EF6080.5010806@gmail.com>
References: <54EF46B7.3000809@gmail.com>
 <d86bc63267de8ef6177457a6df7ee208@htip.com.br> <54EF6080.5010806@gmail.com>
Message-ID: <c3c0fdae84022aab03028edbfb111af7@htip.com.br>
X-Sender: luis.sa@htip.com.br
User-Agent: RoundCube Webmail/0.5.3
X-Pg-Spam-Score: -1.9 (-)
List-Archive: <http://archives.postgresql.org/pgsql-admin>
List-Help: <mailto:majordomo@postgresql.org?body=help>
List-ID: <pgsql-admin.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@postgresql.org>
List-Post: <mailto:pgsql-admin@postgresql.org>
List-Subscribe: <mailto:majordomo@postgresql.org?body=sub%20pgsql-admin>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
X-Mailing-List: pgsql-admin
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

On Thu, 26 Feb 2015 13:05:52 -0500, John Scalia wrote:
> On 2/26/2015 12:56 PM, luis.sa@htip.com.br wrote:
>> On Thu, 26 Feb 2015 11:15:51 -0500, John Scalia wrote:
>>> Hi all,
>>>
>>> An edict has been handed down here from on high that no script 
>>> shall
>>> ever contain any password in cleartext for any reason. Well this is
>>> problem with a streaming replication standby server's recovery.conf
>>> file as the line primary_conninfo = contains said replication 
>>> user's
>>> password for that connection. Is there any sort of plan to allow 
>>> this
>>> to be md5 or some such encoded? Or what else could I do in this 
>>> case?
>>>
>>> Thx,
>>> Jay
>>
>> Yes. Use ssh key to create a fingerprint.
>>
>> Ex. "ssh-keygen" command to generate a fingerprint. And "ssh-copy-id 
>> postgres@slave" and  "ssh-copy-id user@master" to copy the key to alow 
>> both machines communicated over ssh.
>>
> All systems already have ssh keys shared between them as it's used by
> scp to transmit the WAL archive to both standby servers. How would I
> indicate in the recovery.conf that the embedded password in the line
> primary_conninfo is encrypted? That line only has "user=<the user>
> password=<the password>" I was thinking that the "password=" could
> have something like "md5:<the password>" in it. Or you could just
> specify whichever encryption protocol that was used followed by the
> colon.

Sorry, wrong answer. The password is for role user on postgres and not 
ssh.

Well, i don't know... but the security may be guaranteed for linux in 
permissions (chmod and chown)..


-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin