Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kruMD-0008Dy-UR for pgsql-hackers@arkaria.postgresql.org; Wed, 23 Dec 2020 02:58:34 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kruMC-0002P6-QW for pgsql-hackers@arkaria.postgresql.org; Wed, 23 Dec 2020 02:58:32 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kruMC-0002Ox-IV for pgsql-hackers@lists.postgresql.org; Wed, 23 Dec 2020 02:58:32 +0000 Received: from momjian.us ([72.94.173.45]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kruM4-00077z-Mb for pgsql-hackers@postgresql.org; Wed, 23 Dec 2020 02:58:31 +0000 Received: from bruce by momjian.us with local (Exim 4.92) (envelope-from ) id 1kruLy-0000n8-Di; Tue, 22 Dec 2020 21:58:18 -0500 Date: Tue, 22 Dec 2020 21:58:18 -0500 From: Bruce Momjian To: Stephen Frost Cc: Alastair Turner , Michael Paquier , PostgreSQL-development , Masahiko Sawada Subject: Re: Proposed patch for key managment Message-ID: <20201223025818.GC9170@momjian.us> References: <20201218213624.GG16415@tamriel.snowman.net> <20201219023844.GG28841@momjian.us> <20201219165837.GH28841@momjian.us> <20201220225909.GJ16415@tamriel.snowman.net> <20201221213514.GK28841@momjian.us> <20201222030748.GN28841@momjian.us> <20201222154017.GO28841@momjian.us> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="jI8keyz6grp/JLjh" Content-Disposition: inline In-Reply-To: <20201222154017.GO28841@momjian.us> User-Agent: Mutt/1.10.1 (2018-07-13) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --jI8keyz6grp/JLjh Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Tue, Dec 22, 2020 at 10:40:17AM -0500, Bruce Momjian wrote: > On Mon, Dec 21, 2020 at 10:07:48PM -0500, Bruce Momjian wrote: > > Attached is the script patch. It is also at: > > > > https://github.com/postgres/postgres/compare/master...bmomjian:cfe-sh.diff > > > > I think it still needs docs but those will have to be done after the > > code doc patch is added. > > Here is an updated patch. Are people happy with the Makefile, its > location in the source tree, and the install directory name? I used the > directory name 'auth_commands' because I thought 'auth' was too easily > misinterpreted. I put the scripts in /src/backend/utils/auth_commands. > It also contains a script that can be used for SSL passphrase prompting, > but I haven't written the C code for that yet. Here is a new patch, build on previous patches, which allows for the SSL passphrase to be prompted from the terminal. -- Bruce Momjian https://momjian.us EnterpriseDB https://enterprisedb.com The usefulness of a cup is in its emptiness, Bruce Lee --jI8keyz6grp/JLjh Content-Type: text/x-diff; charset=us-ascii Content-Disposition: attachment; filename="ssl-fd.diff" diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml new file mode 100644 index 639c623..850813e *** a/doc/src/sgml/config.sgml --- b/doc/src/sgml/config.sgml *************** include_dir 'conf.d' *** 1452,1469 **** mechanism is used. ! The command must print the passphrase to the standard output and exit ! with code 0. In the parameter value, %p is ! replaced by a prompt string. (Write %% for a ! literal %.) Note that the prompt string will ! probably contain whitespace, so be sure to quote adequately. A single ! newlines is stripped from the end of the output if present. ! ! ! The command does not actually have to prompt the user for a ! passphrase. It can read it from a file, obtain it from a keychain ! facility, or similar. It is up to the user to make sure the chosen ! mechanism is adequately secure. This parameter can only be set in the postgresql.conf --- 1452,1469 ---- mechanism is used. ! The command must print the passphrase to the standard output ! and exit with code 0. It can prompt from the terminal if ! is used. In the parameter value, ! %R represents the file descriptor number opened ! to the terminal that started the server. A file descriptor is only ! available if enabled at server start. If %R ! is used and no file descriptor is available, the server will not ! start. Value %p is replaced by a pre-defined ! prompt string. (Write %% for a literal ! %.) Note that the prompt string will probably ! contain whitespace, so be sure to quote its use adequately. ! Newlines are stripped from the end of the output if present. This parameter can only be set in the postgresql.conf *************** include_dir 'conf.d' *** 1486,1495 **** parameter is off (the default), then ssl_passphrase_command will be ignored during a reload and the SSL configuration will not be reloaded if a passphrase ! is needed. That setting is appropriate for a command that requires a ! TTY for prompting, which might not be available when the server is ! running. Setting this parameter to on might be appropriate if the ! passphrase is obtained from a file, for example. This parameter can only be set in the postgresql.conf --- 1486,1495 ---- parameter is off (the default), then ssl_passphrase_command will be ignored during a reload and the SSL configuration will not be reloaded if a passphrase ! is needed. This setting is appropriate for a command that requires a ! terminal for prompting, which might not be available when the server is ! running. Setting this parameter on might be appropriate, for ! example, if the passphrase is obtained from a file. This parameter can only be set in the postgresql.conf diff --git a/doc/src/sgml/ref/pg_ctl-ref.sgml b/doc/src/sgml/ref/pg_ctl-ref.sgml new file mode 100644 index f04e417..0662ae0 *** a/doc/src/sgml/ref/pg_ctl-ref.sgml --- b/doc/src/sgml/ref/pg_ctl-ref.sgml *************** PostgreSQL documentation *** 380,387 **** ! Allows the command ! to prompt for a passphrase or PIN. --- 380,388 ---- ! Allows or ! to prompt for a passphrase ! or PIN. diff --git a/doc/src/sgml/ref/pgupgrade.sgml b/doc/src/sgml/ref/pgupgrade.sgml new file mode 100644 index 98be392..b1bcdb7 *** a/doc/src/sgml/ref/pgupgrade.sgml --- b/doc/src/sgml/ref/pgupgrade.sgml *************** PostgreSQL documentation *** 170,176 **** ! allows prompting for a passphrase or PIN --- 170,178 ---- ! allows or ! to prompt for a passphrase ! or PIN. diff --git a/src/backend/libpq/be-secure-common.c b/src/backend/libpq/be-secure-common.c new file mode 100644 index 94cdf4c..1b712cf *** a/src/backend/libpq/be-secure-common.c --- b/src/backend/libpq/be-secure-common.c *************** *** 22,27 **** --- 22,28 ---- #include #include + #include "postmaster/postmaster.h" #include "common/string.h" #include "libpq/libpq.h" #include "storage/fd.h" *************** run_ssl_passphrase_command(const char *p *** 61,66 **** --- 62,80 ---- appendStringInfoString(&command, prompt); p++; break; + case 'R': + { + char fd_str[20]; + + if (terminal_fd == -1) + ereport(ERROR, + (errcode(ERRCODE_INTERNAL_ERROR), + errmsg("ssl_passphrase_command referenced %%R, but -R not specified"))); + p++; + snprintf(fd_str, sizeof(fd_str), "%d", terminal_fd); + appendStringInfoString(&command, fd_str); + break; + } case '%': appendStringInfoChar(&command, '%'); p++; --jI8keyz6grp/JLjh--