From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Andreas Karlsson <andreas@proxel.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: Michael Banck <michael.banck@credativ.de>
Cc: Peter Geoghegan <pg@heroku.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Date: Wed, 4 Jan 2017 11:49:58 -0500
Message-ID: <20170104164958.GR18360@tamriel.snowman.net> (raw)
In-Reply-To: <97c1bad2-ac72-052a-0525-1d115f094f15@2ndquadrant.com>
References: <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
<20995.1483541230@sss.pgh.pa.us>
<CABUevExdkO3TTLYhc2oQAOWXbnz+mJ8=Tfg+WsB2P6p-_wfYyg@mail.gmail.com>
<7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
<20170104151429.GP18360@tamriel.snowman.net>
<1254e97b-a65a-5a63-e938-810507a16d71@proxel.se>
<22644.1483543579@sss.pgh.pa.us>
<cf2ea102-13cd-d51a-8dfe-dfe6b9269e63@2ndquadrant.com>
<23703.1483545440@sss.pgh.pa.us>
<97c1bad2-ac72-052a-0525-1d115f094f15@2ndquadrant.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 1/4/17 10:57 AM, Tom Lane wrote:
> > I still maintain that the existing solution for passphrases is useless,
> > but in the interest of removing objections to the current patch, I'll
> > go make that happen.
>
> Sounds good.
Agreed, thanks.
> Looking around briefly (e.g., Apache, nginx), the standard approach
> appears to be a configuration setting that gets the password from an
> external program or file. (Although the default still appears to be to
> get from tty.)
Right, the MIT Kerberos daemon will definitely prompt for the passphrase
for the master key on the terminal also. They might also have a way to
get it from a program now, not sure, it's been a while, but it was a
requirement from NIST 800-53 to not have unencrypted keys on the
filesystem and I had to address that for the MIT Kerberos master key and
the private keys for various SSL-using services.
> systemd has support for getting passwords to services without tty.
Oh, that's interesting, I wasn't aware of that.
> So if someone is interested, there is some room for enhancement here.
Agreed.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, tgl@sss.pgh.pa.us, andreas@proxel.se, magnus@hagander.net, michael.paquier@gmail.com, michael.banck@credativ.de, pg@heroku.com
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
In-Reply-To: <20170104164958.GR18360@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox