Subject: Re: What are best practices wrt passwords?

From: Bruce Momjian <[email-masked]>
Date: Wed, 16 Oct 2024 12:33:01 -0400

On Wed, Oct 16, 2024 at 06:16:57PM +0200, [email-masked] wrote:
> On 2024-10-16, at 14:41, Dominique Devienne <[email-masked]> wrote:
> 
> > On Wed, Oct 16, 2024 at 2:25 PM <[email-masked]> wrote:
> >> I'd like to be able to use psql without typing passwords again and
> >> again.  I know about `.pgpass` and PGPASSFILE, but I specifically do not
> >> want to use it - I have the password in the `.env` file, and having it
> >> in _two_ places comes with its own set of problems, like how to make
> >> sure they don't get out of sync.
> >
> > What's wrong with PGPASSWORD?
> > https://www.postgresql.org/docs/current/libpq-envars.html
> 
> `ps auxe` shows all processes with their environments, no?

I think that only shows for super-user.

-- 
  Bruce Momjian  <[email-masked]>        https://momjian.us
  EDB                                      https://enterprisedb.com

  When a patient asks the doctor, "Am I going to die?", he means 
  "Am I going to die soon?"

---

From: Tom Lane <[email-masked]>
Date: Wed, 16 Oct 2024 12:47:25 -0400

> I think that only shows for super-user.

I believe it depends on your platform --- some BSDen are pretty
permissive about this, if memory serves.  On a Linux box it seems
to work for processes owned by yourself even if you're not superuser.

			regards, tom lane

---

From: Christophe Pettus <[email-masked]>
Date: Wed, 16 Oct 2024 09:50:41 -0700

> On Oct 16, 2024, at 09:47, Tom Lane <[email-masked]> wrote:

I just tried it on an (admittedly kind of old) Ubuntu system and MacOS 14, and it looks like shows everything owned by everyone, even from a non-sudoer user.

---

From: "Peter J. Holzer" <[email-masked]>
Date: Wed, 16 Oct 2024 23:27:15 +0200

On 2024-10-16 09:50:41 -0700, Christophe Pettus wrote:
> I just tried it on an (admittedly kind of old) Ubuntu system and MacOS
> 14, and it looks like shows everything owned by everyone, even from a
> non-sudoer user.

On Linux, unprivileged users can only see the environment of their own
processes since a *very* long time ago. Possibly even before Ubuntu even
existed. So I'm somewhat sceptical about that. Some other Unixes were
more permissive. I don't know what camp MacOS falls into.

        hp

-- 
   _  | Peter J. Holzer    | Story must make more sense than reality.
|_|_) |                    |
| |   | [email-masked]         |    -- Charles Stross, "Creative writing
__/   | http://www.hjp.at/ |       challenge!"

---

From: Bruce Momjian <[email-masked]>
Date: Wed, 16 Oct 2024 17:37:19 -0400

> more permissive. I don't know what camp MacOS falls into.

Yes, I thought this was fixed long ago.

---

From: Tom Lane <[email-masked]>
Date: Wed, 16 Oct 2024 18:03:15 -0400

> more permissive. I don't know what camp MacOS falls into.

I poked at that on current macOS (Sequoia).  The rule for unprivileged
users seems to be the same as on Linux: you can see the environment
variables of processes belonging to you.  What is really interesting
is that "sudo ps auxwwe" and "ps auxwwe" have the same results: you
can still see only your own processes' environment variables.  The
sole exception when I tried it was that under sudo the root-owned "ps"
command showed its own environment variables, which is pretty bizarre.
Looks like the test is not actually on the reported process ownership
but some inherited property.

To confuse matters even more, another machine that's running Sequoia
but with SIP turned off acts more like Linux: "sudo ps auxwwe" shows
environment variables for everything.  So Apple's marching to their
own drummer as usual, but it doesn't look like there's any case where
they are more permissive than the Linux rule.  I'm still not convinced
about whether all *BSD flavors match that, though.

			regards, tom lane