Date: Wed, 16 Dec 2020 17:18:12 -0500
From: Bruce Momjian <bruce@momjian.us>
To: Alastair Turner <minion@decodable.me>
Cc: Stephen Frost <sfrost@snowman.net>,
	Michael Paquier <michael@paquier.xyz>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>,
	Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Proposed patch for key managment
Message-ID: <20201216221812.GE4527@momjian.us>
References: <X9hHoQcZ11pBtgnz@paquier.xyz>
 <20201215031902.GB14596@momjian.us>
 <20201215190909.GK16415@tamriel.snowman.net>
 <CAC0GmyyCqGrP7GpZCzGyJQZPqKBLJr9Nyqr5Q6Tdzy_UmJ96jg@mail.gmail.com>
 <20201216001228.GC14807@momjian.us>
 <CAC0Gmyy7QCvh4ey-e_XXYCHDEmaKKoeaagAFuAmhF=tS0DU4-A@mail.gmail.com>
 <20201216184257.GA4527@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="tjCHc7DPkfUGtrlw"
Content-Disposition: inline
In-Reply-To: <20201216184257.GA4527@momjian.us>
User-Agent: Mutt/1.10.1 (2018-07-13)
Precedence: bulk


--tjCHc7DPkfUGtrlw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Wed, Dec 16, 2020 at 01:42:57PM -0500, Bruce Momjian wrote:
> On Wed, Dec 16, 2020 at 06:07:26PM +0000, Alastair Turner wrote:
> > Hi Bruce
> > 
> > On Wed, 16 Dec 2020 at 00:12, Bruce Momjian <bruce@momjian.us> wrote:
> > >
> > ...
> > >
> > > The second approach is to make a new API for what you want....
> > 
> > I am trying to motivate for an alternate API. Specifically, an API
> > which allows any potential adopter of Postgres and Cluster File
> > Encryption to adopt them without having to accept any particular
> > approach to key management, key derivation, wrapping, validation, etc.
> > A passphrase key-wrapper with validation will probably be very useful
> > to a lot of people, but making it mandatory and requiring twists and
> > turns to integrate with already-established security infrastructure
> > sounds like a barrier to adoption.
> 
> Attached is a script that uses the AWS Secrets Manager, and it does key
> rotation with the new pg_altercpass tool too, just like all the other
> methods.

Attached is an improved script that does not pass the secret on the
command line.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EnterpriseDB                             https://enterprisedb.com

  The usefulness of a cup is in its emptiness, Bruce Lee


--tjCHc7DPkfUGtrlw
Content-Type: application/x-sh
Content-Disposition: attachment; filename="pass_aws.sh"
Content-Transfer-Encoding: quoted-printable

:=0A=0A# This uses the AWS Secrets Manager using the AWS CLI=0A=0A[ "$#" -n=
e 1 ] && echo "cluster_passphrase_command usage: $0 \"%d\"" 1>&2 && exit 1=
=0A# No need for %R or -R since we are not prompting=0A=0ADIR=3D"$1"=0A=0A#=
 File containing the passphrased encrypted with the PIV_SLOT's public key=
=0AAWS_ID_FILE=3D"$DIR/aws-secret.id"=0A=0A=0A# Create an AWS Secrets Manag=
er secret?=0Aif [ ! -e "$AWS_ID_FILE" ]=0Athen	# The 'postgres' operating s=
ystem user must have permission to=0A	# access the AWS CLI=0A=0A	TIME=3D$(d=
ate '+%s')=0A	# The directory/time combination is unique=0A	HASH=3D$(echo -=
n "$DIR$TIME" | sha1sum | awk '{print $1}')=0A	AWS_SECRET_ID=3D"Postgres-pa=
ssphrase-$HASH"=0A=0A	# Use stdin to avoid passing the secret on the comman=
d line=0A	openssl rand -hex 32 |=0A	xxd -plain -cols 999 |=0A	aws secretsma=
nager create-secret \=0A		--name "$AWS_SECRET_ID" \=0A		--description 'Used=
 for Postgres cluster file encryption' \=0A		--secret-string 'file:///dev/s=
tdin' \=0A		--output text > /dev/null=0A	[ "$?" -ne 0 ] && exit 1=0A=0A	ech=
o "$AWS_SECRET_ID" > "$AWS_ID_FILE"=0Afi=0A=0Aif ! aws secretsmanager get-s=
ecret-value \=0A	--secret-id "$(cat "$AWS_ID_FILE")" \=0A	--output text=0At=
hen	exit 1=0Afi | awk -F'\t' 'NR =3D=3D 1 {print $4}'=0A=0Aexit 0=0A
--tjCHc7DPkfUGtrlw--