Date: Wed, 4 Jan 2017 10:14:29 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Andreas Karlsson <andreas@proxel.se>
Cc: Magnus Hagander <magnus@hagander.net>, Tom Lane <tgl@sss.pgh.pa.us>,
	Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
	Michael Paquier <michael.paquier@gmail.com>,
	Michael Banck <michael.banck@credativ.de>,
	Peter Geoghegan <pg@heroku.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Message-ID: <20170104151429.GP18360@tamriel.snowman.net>
References: <05677cd3-63b2-b15b-7afd-798e34e607c7@proxel.se>
 <CAB7nPqQU50-UMuFcffmynDbH7_kBx3N-Q3ujL-nM2OF3X8biMA@mail.gmail.com>
 <16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com>
 <29982.1483412575@sss.pgh.pa.us>
 <CABUevExczKi876tfqH5dY7QcMQu6v3KFBwckozD_OJr0kgVidw@mail.gmail.com>
 <23913.1483458895@sss.pgh.pa.us>
 <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
 <20995.1483541230@sss.pgh.pa.us>
 <CABUevExdkO3TTLYhc2oQAOWXbnz+mJ8=Tfg+WsB2P6p-_wfYyg@mail.gmail.com>
 <7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="lVeXceEWwX5P4dh7"
Content-Disposition: inline
In-Reply-To: <7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--lVeXceEWwX5P4dh7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Andreas Karlsson (andreas@proxel.se) wrote:
> On 01/04/2017 03:48 PM, Magnus Hagander wrote:
> >On Wed, Jan 4, 2017 at 3:47 PM, Tom Lane <tgl@sss.pgh.pa.us
> >    It does not; what would be the point, if the key would be lost at
> >    SIGHUP?
> >
> >If we lost it, yes. But we could keep the old key around if it hasn't
> >changed, thus behave just like we did in <=3D 9.6.
>=20
> That means storing the pass phrase in the memory of the postmaster,
> which does not sound like a terribly good idea to me, but I have
> never used keys with pass phrases for daemons so it might be a
> common solution which is acceptable by many.

I'm not sure I see that as a big deal- if you can access the
postmaster's memory then you can just pull out the actual private key
itself, no?  There's a bigger issue here though, which has to do with
what happens if the user actually does change the passphrase on the key
and we then reload, what do we do then?

> >    If any of those number of people want to step up and design/implement
> >    a non-broken solution for passphrases, that'd be fine with me.  But
> >    I would want to see something that's actually a credible solution,
> >    allowing the postmaster to be started as a normal daemon.  And worki=
ng
> >    on Windows.
> >
> >Well, for all those people 9.6 worked significantly better... Because
> >they could reload *other* config parameters without failure.
>=20
> A possible solution might be to only add the error throwing hook
> when loading certificates during SIGHUP (and at Windows) and to work
> as before on startup. Would that be an acceptable solution? I could
> write a patch for this if people are interested.

I'm not sure I see how that's a solution..?  Wouldn't that mean that a
SIGHUP with an encrypted key would result in a failure?

The solution, at least in my view, seems to be to say "sorry, we can't
reload the SSL stuff if you used a passphrase to unlock the key on
startup, you will have to perform a restart if you want the SSL bits to
be changed."

No, I've not looked at what that would require in terms of code.

Thanks!

Stephen

--lVeXceEWwX5P4dh7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYbRFUAAoJEO1sijiDR2RVgjwQAKxF62RChrNjKRcGsEil1UMA
4cabPAKkeMWDZIT78njH7Vk2X2Z8OZv30W8vx9auhq5RddQrcjzvcFf2VD3xOiur
N7DgIFEW9Rne/9qKhTSEs3OGzDlt2r60gUSjdoHP7YtAjuoNMqWN6o6owPzXhPtw
+ig214HaAXZAb+PHRcZgdLpR93ztKVYBu52deCndpLuKYu+/iBoGxCJD942M088J
XT3WAewTCRR9AtMUWvu80Sd/O+h254jYsUYnQPm18Re/rfA3fr4a5EVySjaVNUaV
CQY5l0458efME8tLf/KZBcStl5Fc3bAqvGBwZZQvH690A3iAvqNP+zwhUYe1PI/R
TkjENLitlXY1aAiIma2eFHYeJgEqxacGkANzS2ewIPvxFp16xM0UoCEsh7W+h4m8
ZwRYgaYkW7VCDeKiAtA9PqoAV1jHwAW24a4CXk9h/2l8Qik+1wtMt2apy2/wHsuh
KJRXZutJzR9un9PXx7zY0X3csF2cCcnOUMJ9vv6htheBCeGUa28tHFTnubnP+ZnW
USm2k2TYbHDQ+6ngywkuQj7MqTgpsJpwnglmqYfLYCoE+rNslGTvWwjRR99ZYqWp
1LIlXvjvBR3TyhI405VrCCyiv8YtuJw34TKjblBsblmESJELoXG92WAXVW4O7IV5
2DZX3OOiwNozJsgRMWck
=tqyI
-----END PGP SIGNATURE-----

--lVeXceEWwX5P4dh7--