Date: Wed, 4 Jan 2017 11:49:58 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Andreas Karlsson <andreas@proxel.se>,
	Magnus Hagander <magnus@hagander.net>,
	Michael Paquier <michael.paquier@gmail.com>,
	Michael Banck <michael.banck@credativ.de>,
	Peter Geoghegan <pg@heroku.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Message-ID: <20170104164958.GR18360@tamriel.snowman.net>
References: 
 <CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
 <20995.1483541230@sss.pgh.pa.us>
 <CABUevExdkO3TTLYhc2oQAOWXbnz+mJ8=Tfg+WsB2P6p-_wfYyg@mail.gmail.com>
 <7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
 <20170104151429.GP18360@tamriel.snowman.net>
 <1254e97b-a65a-5a63-e938-810507a16d71@proxel.se>
 <22644.1483543579@sss.pgh.pa.us>
 <cf2ea102-13cd-d51a-8dfe-dfe6b9269e63@2ndquadrant.com>
 <23703.1483545440@sss.pgh.pa.us>
 <97c1bad2-ac72-052a-0525-1d115f094f15@2ndquadrant.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="xFQBzfy8IMmn3THN"
Content-Disposition: inline
In-Reply-To: <97c1bad2-ac72-052a-0525-1d115f094f15@2ndquadrant.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--xFQBzfy8IMmn3THN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Peter Eisentraut (peter.eisentraut@2ndquadrant.com) wrote:
> On 1/4/17 10:57 AM, Tom Lane wrote:
> > I still maintain that the existing solution for passphrases is useless,
> > but in the interest of removing objections to the current patch, I'll
> > go make that happen.
>=20
> Sounds good.

Agreed, thanks.

> Looking around briefly (e.g., Apache, nginx), the standard approach
> appears to be a configuration setting that gets the password from an
> external program or file.  (Although the default still appears to be to
> get from tty.)

Right, the MIT Kerberos daemon will definitely prompt for the passphrase
for the master key on the terminal also.  They might also have a way to
get it from a program now, not sure, it's been a while, but it was a
requirement from NIST 800-53 to not have unencrypted keys on the
filesystem and I had to address that for the MIT Kerberos master key and
the private keys for various SSL-using services.

> systemd has support for getting passwords to services without tty.

Oh, that's interesting, I wasn't aware of that.

> So if someone is interested, there is some room for enhancement here.

Agreed.

Thanks!

Stephen

--xFQBzfy8IMmn3THN
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYbSe2AAoJEO1sijiDR2RV0+AQAJgpMDYH9tVyY+RqSpA+4ruc
ESfbPCh1EiBCgZ7iSsD/oDBTzLB7CL8cVBGTWXZkLS/ELd46FaFHyWwAytrbwdpX
UaRVQnBrPT9O/kkmjoVOP7gDdz/Yu5GFZDVXUKD1+PbY6XQcuyDlcvKDQfTRpRr0
J1tqdjfbenbHb9zZSqPeE3ejp+YXKKPxr9uKn4Ho65A3oLQf9Ic+zUoBRkAgJOek
YYv4Cp8trdCSgpL4uNnOC/GcozE2uxC/dgXylBOgpDXG+/5nXb3I2VOmmfJwFOGg
P3rte0BXbZy8EDFlAiE178RRni9R2tgiGJBMDTTt/RxeknSNkHneLRFg1pEZB/FO
Pc8NpsejgzjcyEKhaH9+RS3GIjRRN0EOZ22pTAKiMKkjKUvUrKrwkw0Amd1PrHXX
mOJNgSsWfmcFYZPZnU/w2FPHm7YSRMtRz7xKnOxEuAiUjMOoLgpjDMFpf32IMTzQ
SYKVTsrMnMApPpX2A5xWrZ/J4UjHS7WyW6v6xiDR6r91t/5/SEvhJxGMLXQfgRm0
sJxM7a2X9wNSSLfVLxq7Y8swGooO8jjgzFmaA5Bf3jpWnZBRag151VyJDeMqfSP/
Kccu+IX0McuwOM1FRhRmZQ0514wpqM7se1X/8323Ln5pm2n5UhR9AmMk128FS/SG
p2lq1bUtddxN20zI2i/V
=m4Cf
-----END PGP SIGNATURE-----

--xFQBzfy8IMmn3THN--