From: Bruce Momjian <bruce@momjian.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Ants Aasma <ants.aasma@eesti.ee>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Date: Thu, 15 Jun 2017 17:12:01 -0400
Message-ID: <20170615211201.GC8443@momjian.us> (raw)
In-Reply-To: <CA+TgmoaPbgzNytWPwD43s996eQkOwVATbhXCfhvQ8FkP8cG4JQ@mail.gmail.com>
References: <20170613185622.GO13873@momjian.us>
<20170613192011.GS3151@tamriel.snowman.net>
<a2fa2930-5334-c926-01ee-4a01c605b7a4@2ndquadrant.com>
<20170613221104.GT3151@tamriel.snowman.net>
<9cea5160-c64b-0b9e-d4b7-c57db2a696be@2ndquadrant.com>
<20170614214119.GL1769@tamriel.snowman.net>
<0b5611b8-af0f-152d-9c38-222b081c71ac@2ndquadrant.com>
<CA+TgmoYrQvGkr-6j4fDxJ-SBjhiALzDZcukR2c9s0VeGbWoWaw@mail.gmail.com>
<20170615202942.GA20904@momjian.us>
<CA+TgmoaPbgzNytWPwD43s996eQkOwVATbhXCfhvQ8FkP8cG4JQ@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On Thu, Jun 15, 2017 at 05:04:17PM -0400, Robert Haas wrote:
> > Also, there is the sense that security requires
> > trust of the root user, while using Postgres doesn't require the root
> > user to also use Postgres.
>
> I don't understand this. It is certainly true that you're running
> binaries owned by root, the root user could Trojan the binaries and
> break any security you think you have. But that problem is no better
> or worse for PostgreSQL than anything else.
I couldn't find a cleaner way to see it --- it is that database use
doesn't involve the root user using it, while database security requires
the root user to also be security-conscious.
> > One serious difference between in-database-encryption and SSH keys is
> > that the use of passwords for SSH is well understood and reasonable to
> > use, while I think we all admit that use of passwords for database
> > objects like SSL keys is murky. Use of keys for OS-level encryption is
> > a little better handled, but not as clean as SSH keys.
>
> Peter pointed out upthread that our handling of SSL passphrases leaves
> a lot to be desired, and that maybe we should fix that problem first;
> I agree. But I don't think this is any kind of intrinsic limitation
> of PostgreSQL vs. encrypted filesystems vs. SSH; it's just a
> quality-of-implementation issue.
I think there are environmental issues that make password use on SSH
easier than the other cases --- it isn't just code quality. However, it
would be good to research how SSH handles it to see if we can get any
ideas.
--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bruce@momjian.us, robertmhaas@gmail.com, peter.eisentraut@2ndquadrant.com, sfrost@snowman.net, ants.aasma@eesti.ee
Subject: Re: WIP: Data at rest encryption
In-Reply-To: <20170615211201.GC8443@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox