Date: Wed, 4 Jan 2017 08:48:36 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Magnus Hagander <magnus@hagander.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Michael Paquier <michael.paquier@gmail.com>,
	Andreas Karlsson <andreas@proxel.se>,
	Michael Banck <michael.banck@credativ.de>,
	Peter Geoghegan <pg@heroku.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Message-ID: <20170104134836.GI18360@tamriel.snowman.net>
References: 
 <CAB7nPqTHXFJATf+aeqDLRAA_6Y5p2v6AoV_AtNy=ZdCjxOjyEQ@mail.gmail.com>
 <6d45be21-637b-c802-75e7-1ea634ed4089@proxel.se>
 <CAB7nPqThxqDOt_pmJ0d4hHogtmZg=uh=Toez+WyOZzwaCZNSCg@mail.gmail.com>
 <05677cd3-63b2-b15b-7afd-798e34e607c7@proxel.se>
 <CAB7nPqQU50-UMuFcffmynDbH7_kBx3N-Q3ujL-nM2OF3X8biMA@mail.gmail.com>
 <16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com>
 <29982.1483412575@sss.pgh.pa.us>
 <CABUevExczKi876tfqH5dY7QcMQu6v3KFBwckozD_OJr0kgVidw@mail.gmail.com>
 <23913.1483458895@sss.pgh.pa.us>
 <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="FiJIb0ZaFabftQLn"
Content-Disposition: inline
In-Reply-To: 
 <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--FiJIb0ZaFabftQLn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Magnus Hagander (magnus@hagander.net) wrote:
> On Tue, Jan 3, 2017 at 4:54 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>=20
> > Magnus Hagander <magnus@hagander.net> writes:
> > > On Tue, Jan 3, 2017 at 4:02 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > >> Before we leave this area, though, there is a loose end that requires
> > >> more thought.  That is, what about passphrase-protected server keys?
> > >> ...
> > >> 2. Add a password callback function that would supply the passphrase
> > >> when needed.  The question is, where would it get that from?  It'd
> > >> be straightforward to supply it from a string GUC, but from a securi=
ty
> > >> POV it seems pretty silly to have the password in postgresql.conf.
> >
> > > Yeah, that seems like a really bad idea. If you want to do that, then=
 you
> > > might as well just remove the passphrase from the key.
> >
> > Agreed.  It's difficult to imagine a situation in which postgresql.conf
> > could be considered more secure than server.key, and usually it'd be le=
ss
> > so.
> >
> > >> 3. Add a password callback function that just returns an empty strin=
g,
> > >> thereby ensuring a clean failure if the server tries to load a
> > >> passphrase-protected key.  We'd still need to change the documentati=
on
> > >> but at least the behavior would be reasonably clean.
> >
> > > Another option would be to use a callback to get the key value the fi=
rst
> > > time, and then cache it so we can re-use it. That means we can make it
> > work
> > > if the new key has the same password, but it also means we need to ta=
ke
> > > care of protecting that passphrase. But I'm not sure that's any worse
> > than
> > > the fact that we keep the private key around unlocked today?
> >
> > Yeah, I'm not terribly fussed about having the passphrase sitting in
> > postmaster memory.  But the above is work I don't care to do ATM.
> >
> > I think probably the right thing for now is to install a do-nothing
> > callback, so that at least we don't have the issue of the postmaster
> > freezing at SIGHUP.  If someone feels like trying to revive support
> > of passphrase-protected server keys, that would be a perfectly fine
> > base to build on; they'd need a callback there anyway.
>=20
> Does it still support passphrase protected ones on startup, or did that g=
et
> thrown out with the bathwater? I think that's definitely a separate thing
> and there are a nontrivial number of people who would be interested in a
> setup where they can use a passphrase to protect it initially, just not
> reload it.

+1

Thanks!

Stephen

--FiJIb0ZaFabftQLn
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYbP00AAoJEO1sijiDR2RVlLkP/imJk+GQPn+1bMSk2afJ4j9D
AtYNyDXZ8/At/HDWyLVt1ESs+GT/TdfVgErNVn2QKG26z9P6SRHVrD2V5CLbpHZR
FAOleHIvuNILNTYjNU7SQT/F4J1ZfEXmdKKn41lJKGzlFL4k+WZFhacM0gYPbZ71
EvDkm/M+2H6khBCs+OJqEqVqwkF62cxU3NCr4dRmk6NbCUVAcFRPFPNcG0y6Lm7O
sLqDBjxuMqQ053OrtYwLv5cOBF8Dm5sl23DXnCQhwrvyb02gHJZLM15nd+P5BK4Q
kkhm6phPHMXRxpja7Hyjzf+jWpZ4V6QpjVf8NzcUj1+o0R3Iv6r2tkw5pS1uhpdL
78wLenfkZIYoBIf/1nJg3eFfYpOBpI/Igk+tO/uPX4bp4CLCWYsIT6Rwmb4WTJwa
7TbzjRjfq/WlsqQMudnWpK9n8H6S71DX0aYklE9CgX5nEa+M6e+ri1cEsBmWLfdh
yAy/n6uD4GZtI6zVjiztaxnAGgBWZojnaulwcUnRbkvUmmPCu6HvkPvLGpNAAb6t
p0X65wRB0hGcReJhPsFu8t8h732Uy8NrPA+FLGxIS7E8Y/ZxouyDfYJHS70HtTv7
IovrQQMXmcpiEdLTCDUav5bOvHxF+G5ciSZA4M63pbMZOpSDWPu2FxiS1ZF8XWsv
aqsPbSKVPwoBoIGOUNtY
=oMaK
-----END PGP SIGNATURE-----

--FiJIb0ZaFabftQLn--