Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1q4Qpv-00032x-9d for pgsql-admin@arkaria.postgresql.org; Wed, 31 May 2023 18:46:19 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1q4Qpt-0006Ii-VJ for pgsql-admin@arkaria.postgresql.org; Wed, 31 May 2023 18:46:17 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1q4Qpt-0006IX-Hb for pgsql-admin@lists.postgresql.org; Wed, 31 May 2023 18:46:17 +0000 Received: from mail-ed1-x535.google.com ([2a00:1450:4864:20::535]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1q4Qpq-002wR8-Lw for pgsql-admin@lists.postgresql.org; Wed, 31 May 2023 18:46:16 +0000 Received: by mail-ed1-x535.google.com with SMTP id 4fb4d7f45d1cf-5149aafef44so135848a12.0 for ; Wed, 31 May 2023 11:46:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybertec-at.20221208.gappssmtp.com; s=20221208; t=1685558772; x=1688150772; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=lMRZknvhuvPXDEmQFsyXJZcQoM/umC6smDO48EsxxIM=; b=BRyA4qfT41OOXqqFiSkCTGUCo9B/wDDHfAuji29JP4x+nzRbBrPTu1YGcMejdYOtPr /sravizGJjcwBiAAqAvmZpDFrBb3MzWgtuAZS0vzAyiGp8jO+KadCWtFzabkem7MHat0 XzPfyKb66v4iRtss+sDuBevX5kE/CEhvcbfqitsBqnSE6VH0evbYNDNoF4TiXq4MY2+v BRNNewDrS/YneUg43FbYRtAgs6nRMzH8gdOAkQSXQrTOUm/ZySmdcGhdcFA+2hzxLESw TLQ+1uTtVK4u/fdHSSGJvn8+TOzEDtIYL2l/Oa3Cpn1IJ1yNbU0oir6tsviBHa5BClRz yefg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685558772; x=1688150772; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=lMRZknvhuvPXDEmQFsyXJZcQoM/umC6smDO48EsxxIM=; b=LXrjUb8vZ1vf3QIL3BrzeuAuQgexiTOMmR5wU8r49nb+fzMHRhreFaw9654PPJxR5B /m6XIX+FrME2JPoMJ37Bjgr+sBWoMcCVKQUglNsYcwpro3AE9GdpL6g0Vu7YyA9KDDVb ZneaYAA14koi6rRuHEmIObyhcNAUDv+/ZEdklJhbgk3ctEP2qFkZhadgK7SQyv026YeE eBzP1gv2L69qP98fulHJhmA+xVaZDCvQoWQLRBI29UIQN9yzCDIscd6/DQ4NbdTECCzf hbxIn/SPToKSIf6BvqVnhh3lZVb4F11T1kxJSGmPQHZq7l40o/4nsLcKn+UroLkzzSxx oY3Q== X-Gm-Message-State: AC+VfDyBy8LlrXefIRQLjoJwRb310L8PxlrrncMXpC+KwhxZ5BLq+pqW p9xF1OQ1xzBxGCdaEOV/5+qhnch5t2jsJrudO58= X-Google-Smtp-Source: ACHHUZ5Psp+U4Tuej8IvXtNkJ8W1RlarzeYooS2ua1V0//8uyxVV3XBeSdtOEzLEgp3X9qUtVwsqCw== X-Received: by 2002:a17:907:7285:b0:96b:e92:4feb with SMTP id dt5-20020a170907728500b0096b0e924febmr5867568ejc.60.1685558772286; Wed, 31 May 2023 11:46:12 -0700 (PDT) Received: from localhost.localdomain (62-46-251-30.adsl.highway.telekom.at. [62.46.251.30]) by smtp.gmail.com with ESMTPSA id f16-20020a17090624d000b0096b20c968afsm9251410ejb.124.2023.05.31.11.46.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 31 May 2023 11:46:11 -0700 (PDT) Message-ID: Subject: Re: PG Database Encryption From: Laurenz Albe To: Ravi GH , depesz@depesz.com Cc: Pgsql-admin Date: Wed, 31 May 2023 20:46:11 +0200 In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.46.4 (3.46.4-1.fc37) MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On Mon, 2023-05-29 at 17:28 +0530, Ravi GH wrote: > I tried the suggested option of TDE , to enable Cluster Level Encryption.= I had followed the > "Installation from Source Code" method with=C2=A0--with-ssl=3Dopenssl par= ameter to ./configure during build. >=20 > 1. Please confirm the enabling encryption=C2=A0is possible only by instal= l from source with --with-ssl parameter? Sounds right. > 2. I could enable encryption using PG 12 with patched version provided=C2= =A0at here=C2=A0, do we need to purchase > the product or is it possible with Postgres source shared at=C2=A0http= s://www.postgresql.org/ftp/source/v14.7/ It is free open source. You can get the patched version for different releases here: https://github.com/cybertec-postgresql/postgres/tags > We are using Ubuntu 22 and we will prefer to go with TDE cluster level en= cryption, please advise can we try > to implement it by install from source ( with shared source at=C2=A0https= ://www.postgresql.org/ftp/source/v14.7 ) > or need to purchasing=C2=A0TDE patched version is mandatory to enable clu= ster level encryption? That should be here: https://github.com/cybertec-postgresql/postgres/releas= es/tag/PG_14_7_TDE_1_1_3 Yours, Laurenz Albe