From: Stephen Frost <sfrost@snowman.net>
To: Andreas Karlsson <andreas@proxel.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: Michael Banck <michael.banck@credativ.de>
Cc: Peter Geoghegan <pg@heroku.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Date: Wed, 4 Jan 2017 10:14:29 -0500
Message-ID: <20170104151429.GP18360@tamriel.snowman.net> (raw)
In-Reply-To: <7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
References: <05677cd3-63b2-b15b-7afd-798e34e607c7@proxel.se>
<CAB7nPqQU50-UMuFcffmynDbH7_kBx3N-Q3ujL-nM2OF3X8biMA@mail.gmail.com>
<16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com>
<29982.1483412575@sss.pgh.pa.us>
<CABUevExczKi876tfqH5dY7QcMQu6v3KFBwckozD_OJr0kgVidw@mail.gmail.com>
<23913.1483458895@sss.pgh.pa.us>
<CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
<20995.1483541230@sss.pgh.pa.us>
<CABUevExdkO3TTLYhc2oQAOWXbnz+mJ8=Tfg+WsB2P6p-_wfYyg@mail.gmail.com>
<7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
* Andreas Karlsson (andreas@proxel.se) wrote:
> On 01/04/2017 03:48 PM, Magnus Hagander wrote:
> >On Wed, Jan 4, 2017 at 3:47 PM, Tom Lane <tgl@sss.pgh.pa.us
> > It does not; what would be the point, if the key would be lost at
> > SIGHUP?
> >
> >If we lost it, yes. But we could keep the old key around if it hasn't
> >changed, thus behave just like we did in <= 9.6.
>
> That means storing the pass phrase in the memory of the postmaster,
> which does not sound like a terribly good idea to me, but I have
> never used keys with pass phrases for daemons so it might be a
> common solution which is acceptable by many.
I'm not sure I see that as a big deal- if you can access the
postmaster's memory then you can just pull out the actual private key
itself, no? There's a bigger issue here though, which has to do with
what happens if the user actually does change the passphrase on the key
and we then reload, what do we do then?
> > If any of those number of people want to step up and design/implement
> > a non-broken solution for passphrases, that'd be fine with me. But
> > I would want to see something that's actually a credible solution,
> > allowing the postmaster to be started as a normal daemon. And working
> > on Windows.
> >
> >Well, for all those people 9.6 worked significantly better... Because
> >they could reload *other* config parameters without failure.
>
> A possible solution might be to only add the error throwing hook
> when loading certificates during SIGHUP (and at Windows) and to work
> as before on startup. Would that be an acceptable solution? I could
> write a patch for this if people are interested.
I'm not sure I see how that's a solution..? Wouldn't that mean that a
SIGHUP with an encrypted key would result in a failure?
The solution, at least in my view, seems to be to say "sorry, we can't
reload the SSL stuff if you used a passphrase to unlock the key on
startup, you will have to perform a restart if you want the SSL bits to
be changed."
No, I've not looked at what that would require in terms of code.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, andreas@proxel.se, magnus@hagander.net, tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, michael.paquier@gmail.com, michael.banck@credativ.de, pg@heroku.com
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
In-Reply-To: <20170104151429.GP18360@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox