pg.ddx.io pgsql-hackers@postgresql.org mailing list archive help / color / mirror / Atom feed From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: Andreas Karlsson <andreas@proxel.se>
Cc: Michael Banck <michael.banck@credativ.de>
Cc: Peter Geoghegan <pg@heroku.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Date: Mon, 02 Jan 2017 22:02:55 -0500
Message-ID: <29982.1483412575@sss.pgh.pa.us> (raw )
In-Reply-To: <16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com >
References: <28784.1440554271@sss.pgh.pa.us >
<CAB7nPqRFffNTnTo5indiY_5oRavF-XN1vN1JC9WZeUYW3ZYqaw@mail.gmail.com >
<8b967b1e-4bdf-5fd7-9ccb-ce4cfa1d2b3a@proxel.se >
<861d27e2-a642-2725-ae31-e375962ab700@proxel.se >
<fb936d6f-6b83-702f-0b46-6aeef64bf7d3@proxel.se >
<CAB7nPqSFMTfOdWev=+pTHQAb7bSoYBnm-=+CD5ay59v4c4JvUw@mail.gmail.com >
<cf48a889-e890-0441-a1ed-57aea18c4b23@proxel.se >
<0927799d-9f32-7b40-4fe3-04a281365b7a@proxel.se >
<CAB7nPqT0pufs3b9W5XMMDEJ4XXDbN2x73Cpm-XaZCzwGTXRFeA@mail.gmail.com >
<CAB7nPqQq_TUe4v0U_jPAYo5xkEo9Qnj94U5sddeRBtjSPMXXQQ@mail.gmail.com >
<2c1d1551-fd71-113f-7f45-f2379884bf85@proxel.se >
<CAB7nPqR=8Q9FSbj8PL2oOL2FRmAiqOh8Tqj6tuyqDard4zeuXA@mail.gmail.com >
<CAB7nPqTHXFJATf+aeqDLRAA_6Y5p2v6AoV_AtNy=ZdCjxOjyEQ@mail.gmail.com >
<6d45be21-637b-c802-75e7-1ea634ed4089@proxel.se >
<CAB7nPqThxqDOt_pmJ0d4hHogtmZg=uh=Toez+WyOZzwaCZNSCg@mail.gmail.com >
<05677cd3-63b2-b15b-7afd-798e34e607c7@proxel.se >
<CAB7nPqQU50-UMuFcffmynDbH7_kBx3N-Q3ujL-nM2OF3X8biMA@mail.gmail.com >
<16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com >
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Peter Eisentraut <peter.eisentraut@2ndquadrant.com> writes:
> Yeah, it seems that if you want to know whether you are using SSL, then
> we already have that. I don't see the need for this new read-only setting.
I concur --- there might be use for more reporting about SSL status, but
that patch doesn't seem like quite the right thing.
I've pushed the main patch with some small adjustments; one notable one
that I made the EXEC_BACKEND reload path work like SIGHUP reload (press on
without SSL if fail) not server start (abort if fail). As it stood, if
you fat-fingered a change to your SSL files on Windows, the postmaster
would keep running but all backends would die instantly, whether or not
an SSL connection was being requested. That didn't seem helpful.
I also went ahead and downgraded the "hostssl record with SSL turned off"
case to a warning.
Before we leave this area, though, there is a loose end that requires
more thought. That is, what about passphrase-protected server keys?
Our documentation suggests that if you have one, the server will demand
the passphrase just once at server start and then all is good. I'm not
sure if that's at all practical in modern usage, but in any case it's
not going to be reasonable to put a passphrase in again at every SIGHUP.
On Windows things are even worse; you'd have to give the passphrase again
to every spawned backend. (But that was true already.)
I can think of at least three things we might do about this:
1. Leave the code as it stands, and change the documentation to state
that you cannot use a passphrase-protected server key, period.
2. Add a password callback function that would supply the passphrase
when needed. The question is, where would it get that from? It'd
be straightforward to supply it from a string GUC, but from a security
POV it seems pretty silly to have the password in postgresql.conf.
3. Add a password callback function that just returns an empty string,
thereby ensuring a clean failure if the server tries to load a
passphrase-protected key. We'd still need to change the documentation
but at least the behavior would be reasonably clean.
I'm kinda leaning to the last choice; I don't want to leave things as they
are, but actually making password-protected keys work in a useful way
seems like a lot more effort than is justified.
regards, tom lane
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
view thread (69+ messages) latest in thread
Message-ID: <29982.1483412575@sss.pgh.pa.us>
Permalink: ../29982.1483412575@sss.pgh.pa.us/
Also on: postgresql.org/message-id/29982.1483412575@sss.pgh.pa.us
copy link · copy postgr.es
reply Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, michael.paquier@gmail.com, andreas@proxel.se, michael.banck@credativ.de, pg@heroku.com
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
In-Reply-To: <29982.1483412575@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox