Subject: Re: How to encrypt password in pgpass file
To: pgsql-admin@lists.postgresql.org
References: <DCB731A2-6896-4669-A6C1-69D5A730829B@gmail.com>
 <87eeh6xnyy.fsf@gmail.com> <20210224044223.7cwkbced3ticu6bk@raf.org>
From: Ron <ronljohnsonjr@gmail.com>
Message-ID: <c7a664cb-e233-3390-ce62-e832d753e66f@gmail.com>
Date: Tue, 23 Feb 2021 23:40:37 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <20210224044223.7cwkbced3ticu6bk@raf.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Precedence: bulk

On 2/23/21 10:42 PM, raf wrote:
[snip]
> Sometimes, the security requirements are for
> encryption-at-rest, and it doesn't particularly matter
> if encryption-at-rest is actually secure against likely
> threats (sadly).
>
> For example, you could use file system encryption (e.g.
> ecryptfs/LUKS/Linux, FileVault/macOS,
> BitLocker/Windows). Then all of your files are
> encrypted at rest, including .pgpass.
>
> But it's only secure when the computer is powered down
> (i.e. if it is physically stolen, or the disk is
> physically removed). It provides no security for a
> computer that is up and running, and compromised.
>
> But that might satisfy the parties that make up the
> requirements. It all depends on the threat model that
> they need to address.

I see the same thing when SQL Server systems are audited.  One of the check 
boxes is "encrypted database".  I say, "encrypt columns, and modify the 
application to decrypt the columns"; the customer laughs, and asks about 
TDE, which I implement.

Of course, these systems are VMs and SQL Server is rarely turned off, so it 
serves no practical purpose other than to encrypt the backups.  Auditors 
don't understand that, hear "it's encrypted" and are happy when I show them 
AES-128 and that I rotate the key yearly.

-- 
Angular momentum makes the world go 'round.