Subject: Re: WIP: Data at rest encryption
To: Stephen Frost <sfrost@snowman.net>, Bruce Momjian <bruce@momjian.us>
References: <20170613162301.GF3151@tamriel.snowman.net>
 <20170613164442.GD13873@momjian.us>
 <20170613170132.GH3151@tamriel.snowman.net>
 <20170613171356.GG13873@momjian.us>
 <20170613172459.GL3151@tamriel.snowman.net>
 <20170613174329.GK13873@momjian.us>
 <20170613182339.GP3151@tamriel.snowman.net>
 <20170613182910.GN13873@momjian.us>
 <20170613183858.GR3151@tamriel.snowman.net>
 <20170613185622.GO13873@momjian.us>
 <20170613192011.GS3151@tamriel.snowman.net>
Cc: Ants Aasma <ants.aasma@eesti.ee>, Robert Haas <robertmhaas@gmail.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Organization: 2ndQuadrant
Message-ID: <3550f152-9349-ee2b-edae-a8ec09d8d9fc@2ndquadrant.com>
Date: Tue, 13 Jun 2017 15:45:05 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.1.1
MIME-Version: 1.0
In-Reply-To: <20170613192011.GS3151@tamriel.snowman.net>
Content-Type: text/plain; charset=windows-1252
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

On 6/13/17 15:20, Stephen Frost wrote:
> For example, you could simply do: 
> 
> cp -a /path/to/PG /mnt/usb
> 
> and you're done.  If you're using filesystem level encryption then you'd
> have to re-encrypt the data, using something like:
> 
> tar -cf - /path/to/PG | openssl -key private.key > /mnt/usb/encrypted_cluster.tar
> 
> And then you would need openssl on the other system to decrypt it.

Or make the USB file system encrypted as well?  If you're in that kind
of environment, that would surely be feasible, if not required.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers