From: Ron <ronljohnsonjr@gmail.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: How to encrypt password in pgpass file
Date: Tue, 23 Feb 2021 23:40:37 -0600
Message-ID: <c7a664cb-e233-3390-ce62-e832d753e66f@gmail.com> (raw)
In-Reply-To: <20210224044223.7cwkbced3ticu6bk@raf.org>
References: <DCB731A2-6896-4669-A6C1-69D5A730829B@gmail.com>
<87eeh6xnyy.fsf@gmail.com>
<20210224044223.7cwkbced3ticu6bk@raf.org>
On 2/23/21 10:42 PM, raf wrote:
[snip]
> Sometimes, the security requirements are for
> encryption-at-rest, and it doesn't particularly matter
> if encryption-at-rest is actually secure against likely
> threats (sadly).
>
> For example, you could use file system encryption (e.g.
> ecryptfs/LUKS/Linux, FileVault/macOS,
> BitLocker/Windows). Then all of your files are
> encrypted at rest, including .pgpass.
>
> But it's only secure when the computer is powered down
> (i.e. if it is physically stolen, or the disk is
> physically removed). It provides no security for a
> computer that is up and running, and compromised.
>
> But that might satisfy the parties that make up the
> requirements. It all depends on the threat model that
> they need to address.
I see the same thing when SQL Server systems are audited. One of the check
boxes is "encrypted database". I say, "encrypt columns, and modify the
application to decrypt the columns"; the customer laughs, and asks about
TDE, which I implement.
Of course, these systems are VMs and SQL Server is rarely turned off, so it
serves no practical purpose other than to encrypt the backups. Auditors
don't understand that, hear "it's encrypted" and are happy when I show them
AES-128 and that I rotate the key yearly.
--
Angular momentum makes the world go 'round.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: ronljohnsonjr@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: How to encrypt password in pgpass file
In-Reply-To: <c7a664cb-e233-3390-ce62-e832d753e66f@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox