Date: Wed, 21 Feb 2018 22:04:25 -0500 (PET)
Subject: RE: Postgres user password
Message-ID: <qban05telj3fc8cc08bngpgo.1519268651193@email.android.com>
From: Alvaro Aguayo Garcia-Rada <aaguayo@opensysperu.com>
To: pgsql-admin@postgresql.org, pgsql-admin@lists.postgresql.org, Azimuddin
 Mohammed <azimeiu@gmail.com>
MIME-Version: 1.0
In-Reply-To: 
 <CAKUuFd7RyAQEH2-NH8rXNkc-_36LifpDmLjXjmMZ30=75dPfxA@mail.gmail.com>
References: 
 <CAKUuFd7t49TPfA5S8ExhOSNhrMrhz9GTTvnJBu_Sj7LaBshytA@mail.gmail.com>
 <CAKUuFd7q3_aLSJvwQFyPYHf=oKG87=0YSDQCuKRJvng4oNiUqA@mail.gmail.com>
 <CAKUuFd5XjVqp7in=23X=z7FpG_A83xTpcW10CnPOt9YxAarmtw@mail.gmail.com>
 <CAKUuFd6QQsuxE-Jkoqcd1Wb6PSiMUPmiCLWuSdLFxSSx695Fqg@mail.gmail.com>
 <CAKUuFd5-ZRFaL1M1KsPz85Gid4E7MBGV+SB3eXd-akbKXwFsSA@mail.gmail.com>
 <CAKUuFd7RyAQEH2-NH8rXNkc-_36LifpDmLjXjmMZ30=75dPfxA@mail.gmail.com>
Content-Type: multipart/alternative;
	boundary="----=_Part_146810_1619133922.1519268665109"
Thread-Topic: Postgres user password
Thread-Index: Hy16oRYf9tDj+0KAYck2SMwzKGbLOw==
Precedence: bulk

------=_Part_146810_1619133922.1519268665109
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

There are some possible solutions:

- .pgpass file, which permissions can be changed so only owner can read it
- PGPASS environment variable. Don't discard it right away, because don't h=
ave to set this variable pn the script itself; you can set it into your .ba=
sh_profile, and change its permissions so only owner can read it. You can e=
ven use some openssl commands so that it is never stored in clear text.
- Playing a bit with pg_hba.conf . You can use "trust" authentication for U=
NIX socket connections, or create a user intended only for backup(read only=
 access) with "trust" authentication for the specific database for UNIX soc=
ket or localhost connections. With this, you won't have to use a password.
- Further on the pg_hba.conf tricks, you can create a postgres user with th=
e same name as the linux user running your tasks, and add a line for such u=
ser with "ident" authentication, so the user will not require password only=
 if the task is running as such linux user and using UNIX socket connection=
.

Regards,

Alvaro Aguayo
Jefe de Operaciones
Open Comb Systems E.I.R.L.

Oficina: (+51-1)=C2=A03377813=C2=A0| RPM: #034252 / (+51)=C2=A0995540103=C2=
=A0 | RPC: (+51)=C2=A0954183248
Website:=C2=A0www.ocs.pe

Sent from my Sony Xperia=E2=84=A2 smartphone

---- Azimuddin Mohammed wrote ----

Hello,
I have setup my postgres server with postgres as a super user with
password. Everytimg when i connect to postgress as super user i have to
login with password. My question is how can I automate the scripts for back
up and restore that will require password while taking backup or doing
restore. We do not want to store the password in the script due to security
concerns. Is there a way to do ?

------=_Part_146810_1619133922.1519268665109
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<html><body><div>There are some possible solutions:<br><br>- .pgpass file, =
which permissions can be changed so only owner can read it<br>- PGPASS envi=
ronment variable. Don&#39;t discard it right away, because don&#39;t have t=
o set this variable pn the script itself; you can set it into your .bash_pr=
ofile, and change its permissions so only owner can read it. You can even u=
se some openssl commands so that it is never stored in clear text.<br>- Pla=
ying a bit with pg_<a href=3D"http://hba.conf">hba.conf</a> . You can use &=
quot;trust&quot; authentication for UNIX socket connections, or create a us=
er intended only for backup(read only access) with &quot;trust&quot; authen=
tication for the specific database for UNIX socket or localhost connections=
. With this, you won&#39;t have to use a password.<br>- Further on the pg_<=
a href=3D"http://hba.conf">hba.conf</a> tricks, you can create a postgres u=
ser with the same name as the linux user running your tasks, and add a line=
 for such user with &quot;ident&quot; authentication, so the user will not =
require password only if the task is running as such linux user and using U=
NIX socket connection.<br><br>Regards,<br><br>Alvaro Aguayo<br>Jefe de Oper=
aciones<br>Open Comb Systems E.I.R.L.<br><br>Oficina: (<a href=3D"tel:+51-1=
">+51-1</a>)=C2=A0<a href=3D"tel:3377813">3377813</a>=C2=A0| RPM: #034252 /=
 (+51)=C2=A0<a href=3D"tel:995540103">995540103</a>=C2=A0 | RPC: (+51)=C2=
=A0<a href=3D"tel:954183248">954183248</a><br>Website:=C2=A0<a href=3D"http=
://www.ocs.pe">www.ocs.pe</a><br><br>Sent from my Sony Xperia=E2=84=A2 smar=
tphone<br><br>---- Azimuddin Mohammed wrote ----<br><br></div><br><div><div=
 dir=3D"auto">Hello,<div dir=3D"auto">I have setup my postgres server with =
postgres as a super user with password. Everytimg when i connect to postgre=
ss as super user i have to login with password. My question is how can I au=
tomate the scripts for back up and restore that will require password while=
 taking backup or doing restore. We do not want to store the password in th=
e script due to security concerns. Is there a way to do ?</div></div>
</div></body></html>
------=_Part_146810_1619133922.1519268665109--