Date: Sat, 19 Dec 2020 15:22:34 -0500
From: Bruce Momjian <bruce@momjian.us>
To: Alastair Turner <minion@decodable.me>
Cc: Stephen Frost <sfrost@snowman.net>,
	Michael Paquier <michael@paquier.xyz>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>,
	Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Proposed patch for key managment
Message-ID: <20201219202234.GJ28841@momjian.us>
References: <20201216001228.GC14807@momjian.us>
 <CAC0Gmyy7QCvh4ey-e_XXYCHDEmaKKoeaagAFuAmhF=tS0DU4-A@mail.gmail.com>
 <20201216213200.GS16415@tamriel.snowman.net>
 <CAC0Gmyz9w7Axezsu66GVme3u+cR4OmqH5f-nCYNo6-cyxyA3pA@mail.gmail.com>
 <20201216224331.GV16415@tamriel.snowman.net>
 <CAC0GmyyVHstcMefpbCqXC25_Xg4V=Dy-q1ps1a06j9xUOL0SzQ@mail.gmail.com>
 <20201218213624.GG16415@tamriel.snowman.net>
 <20201219023844.GG28841@momjian.us>
 <CAC0GmywbXOWqnU7poYapfnSSd8JuZ0=-fGiumdwA-TumJNuEYg@mail.gmail.com>
 <20201219165837.GH28841@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="MnLPg7ZWsaic7Fhd"
Content-Disposition: inline
In-Reply-To: <20201219165837.GH28841@momjian.us>
User-Agent: Mutt/1.10.1 (2018-07-13)
Precedence: bulk


--MnLPg7ZWsaic7Fhd
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Sat, Dec 19, 2020 at 11:58:37AM -0500, Bruce Momjian wrote:
> My final point is that we can find ways to do what you are suggesting as
> an addition to what we are adding now.  What we need is clear
> justification of why these additional features are needed.  Requiring
> the use of a true random number generator is a valid argument, but we
> need to figure out, once this is implemented, who really wants that, and
> how to implement it cleanly.

I added a comment to this script to explain how to generate a true
random passphrase, attached.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EnterpriseDB                             https://enterprisedb.com

  The usefulness of a cup is in its emptiness, Bruce Lee


--MnLPg7ZWsaic7Fhd
Content-Type: application/x-sh
Content-Disposition: attachment; filename="pass_fd.sh"
Content-Transfer-Encoding: quoted-printable

#!/bin/sh=0A=0A# This uses a passphrase supplied by the user=0A# If OpenSSL=
 is installed, you can generate a passphrase by running:=0A# 	openssl rand =
-hex 32=0A# To get a true random passphrase, run:=0A#	wget -q -O - 'https:/=
/www.random.org/cgi-bin/randbyte?nbytes=3D32&format=3Dh' | tr -d ' \n'; ech=
o=0A=0A[ "$#" -ne 2 ] && echo "cluster_passphrase_command usage: $0 %R \"%P=
\"" 1>&2 && exit 1=0A=0AFD=3D"$1"=0A[ ! -t "$FD" ] && echo "file descriptor=
 $FD does not refer to a terminal" 1>&2 && exit 1=0A=0AMSG=3D"$2"=0A=0A=0A#=
 ----------------------------------------------------------------------=0A=
=0A=0Astty -echo <&"$FD"=0A=0Aecho 1>&"$FD"=0Aecho -n "$MSG" 1>&"$FD"=0Area=
d PASS <&"$FD"=0A=0Astty echo <&"$FD"=0A=0Aif [ ! "$PASS" ]=0Athen	echo 'in=
valid:  empty passphrase' 1>&2=0A	exit 1=0Afi=0A=0Aecho -n "$PASS" |=0A	sha=
256sum |=0A	cut -d' ' -f1=0A=0Aexit 0=0A
--MnLPg7ZWsaic7Fhd--