From: Bruce Momjian <bruce@momjian.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Alastair Turner <minion@decodable.me>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Cc: Masahiko Sawada <masahiko.sawada@2ndquadrant.com>
Subject: Re: Proposed patch for key managment
Date: Tue, 22 Dec 2020 21:58:18 -0500
Message-ID: <20201223025818.GC9170@momjian.us> (raw)
In-Reply-To: <20201222154017.GO28841@momjian.us>
References: <CAC0GmyyVHstcMefpbCqXC25_Xg4V=Dy-q1ps1a06j9xUOL0SzQ@mail.gmail.com>
<20201218213624.GG16415@tamriel.snowman.net>
<20201219023844.GG28841@momjian.us>
<CAC0GmywbXOWqnU7poYapfnSSd8JuZ0=-fGiumdwA-TumJNuEYg@mail.gmail.com>
<20201219165837.GH28841@momjian.us>
<CAC0GmyymnoQEUTzqi9wCCJdg96SbLja4Tc29Wc+xtRpu9Pv76w@mail.gmail.com>
<20201220225909.GJ16415@tamriel.snowman.net>
<20201221213514.GK28841@momjian.us>
<20201222030748.GN28841@momjian.us>
<20201222154017.GO28841@momjian.us>
On Tue, Dec 22, 2020 at 10:40:17AM -0500, Bruce Momjian wrote:
> On Mon, Dec 21, 2020 at 10:07:48PM -0500, Bruce Momjian wrote:
> > Attached is the script patch. It is also at:
> >
> > https://github.com/postgres/postgres/compare/master...bmomjian:cfe-sh.diff
> >
> > I think it still needs docs but those will have to be done after the
> > code doc patch is added.
>
> Here is an updated patch. Are people happy with the Makefile, its
> location in the source tree, and the install directory name? I used the
> directory name 'auth_commands' because I thought 'auth' was too easily
> misinterpreted. I put the scripts in /src/backend/utils/auth_commands.
> It also contains a script that can be used for SSL passphrase prompting,
> but I haven't written the C code for that yet.
Here is a new patch, build on previous patches, which allows for the SSL
passphrase to be prompted from the terminal.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EnterpriseDB https://enterprisedb.com
The usefulness of a cup is in its emptiness, Bruce Lee
Attachments:ssl-fd.diff (text/x-diff, 6.1K) downloaddiff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgmlnew file mode 100644index 639c623..850813e
*** a/doc/src/sgml/config.sgml
--- b/doc/src/sgml/config.sgml
*************** include_dir 'conf.d'
*** 1452,1469 ****
mechanism is used.
</para>
<para>
! The command must print the passphrase to the standard output and exit
! with code 0. In the parameter value, <literal>%p</literal> is
! replaced by a prompt string. (Write <literal>%%</literal> for a
! literal <literal>%</literal>.) Note that the prompt string will
! probably contain whitespace, so be sure to quote adequately. A single
! newlines is stripped from the end of the output if present.
! </para>
! <para>
! The command does not actually have to prompt the user for a
! passphrase. It can read it from a file, obtain it from a keychain
! facility, or similar. It is up to the user to make sure the chosen
! mechanism is adequately secure.
</para>
<para>
This parameter can only be set in the <filename>postgresql.conf</filename>
--- 1452,1469 ----
mechanism is used.
</para>
<para>
! The command must print the passphrase to the standard output
! and exit with code 0. It can prompt from the terminal if
! <option>--authprompt</option> is used. In the parameter value,
! <literal>%R</literal> represents the file descriptor number opened
! to the terminal that started the server. A file descriptor is only
! available if enabled at server start. If <literal>%R</literal>
! is used and no file descriptor is available, the server will not
! start. Value <literal>%p</literal> is replaced by a pre-defined
! prompt string. (Write <literal>%%</literal> for a literal
! <literal>%</literal>.) Note that the prompt string will probably
! contain whitespace, so be sure to quote its use adequately.
! Newlines are stripped from the end of the output if present.
</para>
<para>
This parameter can only be set in the <filename>postgresql.conf</filename>
*************** include_dir 'conf.d'
*** 1486,1495 ****
parameter is off (the default), then
<varname>ssl_passphrase_command</varname> will be ignored during a
reload and the SSL configuration will not be reloaded if a passphrase
! is needed. That setting is appropriate for a command that requires a
! TTY for prompting, which might not be available when the server is
! running. Setting this parameter to on might be appropriate if the
! passphrase is obtained from a file, for example.
</para>
<para>
This parameter can only be set in the <filename>postgresql.conf</filename>
--- 1486,1495 ----
parameter is off (the default), then
<varname>ssl_passphrase_command</varname> will be ignored during a
reload and the SSL configuration will not be reloaded if a passphrase
! is needed. This setting is appropriate for a command that requires a
! terminal for prompting, which might not be available when the server is
! running. Setting this parameter on might be appropriate, for
! example, if the passphrase is obtained from a file.
</para>
<para>
This parameter can only be set in the <filename>postgresql.conf</filename>
diff --git a/doc/src/sgml/ref/pg_ctl-ref.sgml b/doc/src/sgml/ref/pg_ctl-ref.sgmlnew file mode 100644index f04e417..0662ae0
*** a/doc/src/sgml/ref/pg_ctl-ref.sgml
--- b/doc/src/sgml/ref/pg_ctl-ref.sgml
*************** PostgreSQL documentation
*** 380,387 ****
<term><option>--authprompt</option></term>
<listitem>
<para>
! Allows the <option>--cluster-key-command</option> command
! to prompt for a passphrase or PIN.
</para>
</listitem>
</varlistentry>
--- 380,388 ----
<term><option>--authprompt</option></term>
<listitem>
<para>
! Allows <option>ssl_passphrase_command</option> or
! <option>cluster_key_command</option> to prompt for a passphrase
! or PIN.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/ref/pgupgrade.sgml b/doc/src/sgml/ref/pgupgrade.sgmlnew file mode 100644index 98be392..b1bcdb7
*** a/doc/src/sgml/ref/pgupgrade.sgml
--- b/doc/src/sgml/ref/pgupgrade.sgml
*************** PostgreSQL documentation
*** 170,176 ****
<varlistentry>
<term><option>-R</option></term>
<term><option>--authprompt</option></term>
! <listitem><para>allows prompting for a passphrase or PIN
</para></listitem>
</varlistentry>
--- 170,178 ----
<varlistentry>
<term><option>-R</option></term>
<term><option>--authprompt</option></term>
! <listitem><para>allows <option>ssl_passphrase_command</option> or
! <option>cluster_key_command</option> to prompt for a passphrase
! or PIN.
</para></listitem>
</varlistentry>
diff --git a/src/backend/libpq/be-secure-common.c b/src/backend/libpq/be-secure-common.cnew file mode 100644index 94cdf4c..1b712cf
*** a/src/backend/libpq/be-secure-common.c
--- b/src/backend/libpq/be-secure-common.c
***************
*** 22,27 ****
--- 22,28 ----
#include <sys/stat.h>
#include <unistd.h>
+ #include "postmaster/postmaster.h"
#include "common/string.h"
#include "libpq/libpq.h"
#include "storage/fd.h"
*************** run_ssl_passphrase_command(const char *p
*** 61,66 ****
--- 62,80 ----
appendStringInfoString(&command, prompt);
p++;
break;
+ case 'R':+ {+ char fd_str[20];+ + if (terminal_fd == -1)+ ereport(ERROR,+ (errcode(ERRCODE_INTERNAL_ERROR),+ errmsg("ssl_passphrase_command referenced %%R, but -R not specified")));+ p++;+ snprintf(fd_str, sizeof(fd_str), "%d", terminal_fd);+ appendStringInfoString(&command, fd_str);+ break;+ }
case '%':
appendStringInfoChar(&command, '%');
p++;
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: bruce@momjian.us, sfrost@snowman.net, minion@decodable.me, michael@paquier.xyz, masahiko.sawada@2ndquadrant.com
Subject: Re: Proposed patch for key managment
In-Reply-To: <20201223025818.GC9170@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox