pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Antonin Houska <ah@cybertec.at>
To: Bruce Momjian <bruce@momjian.us>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Toshi Harada <harada.toshi@po.ntt-tx.co.jp>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: "WIP: Data at rest encryption" patch and, PostgreSQL 11-beta3
Date: Tue, 25 Jun 2019 14:28:00 +0200
Message-ID: <485700a0-98b6-2fe0-fbab-bc789b59dca9@2ndquadrant.com> (raw)
In-Reply-To: <30017.1560763388@localhost>
References: <14646.1552570130@localhost>
	<CA+Tgmoawc7hQW2SrcvVSfw8JyYV8UU4fyQ56nxKn_BtPhXfhdQ@mail.gmail.com>
	<11812.1554386232@localhost>
	<CA+TgmoaAkO0X8t_FeePfv86tysGw2BZivjFv+7=9cKyvVE9M5w@mail.gmail.com>
	<7567.1556117300@localhost>
	<CA+TgmoaUw3QaHoj_QnkyFVMFLnfsDX32ctOz_zLPReQ-RjAioQ@mail.gmail.com>
	<32714.1559057215@localhost>
	<CA+TgmoYYrB+WQFVhSqkLmmY7G_wM734BUQ7aA4uMtO4bGFp-mA@mail.gmail.com>
	<18987.1559285981@localhost>
	<CA+TgmoYs-TPJXdpLpM1qcib-M_CAMO-7wMxBy3yuuMxs8H4L8Q@mail.gmail.com>
	<20190614011413.svqxbv2ajig2fupa@momjian.us>
	<30017.1560763388@localhost>

On 2019-06-17 11:23, Antonin Houska wrote:
> I'm thinking how to teach postmaster to accept FEBE protocol connections
> temporarily, just to receive the key. The user applications like pg_ctl,
> initdb or pg_upgrade would retrieve the key / password from the DBA, then
> start postmaster and send it the key.
> 
> Perhaps the message format should be a bit generic so that extensions like
> this can use it to receive their keys too.
> 
> (The idea of an unix socket or named pipe I proposed upthread is not good
> because it's harder to implement in a portable way.)

How are the requirements here different from ssl_passphrase_command?
Why do we need a new mechanism?

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services





view thread (37+ messages)  latest in thread

Message-ID: <485700a0-98b6-2fe0-fbab-bc789b59dca9@2ndquadrant.com>
Permalink:  ../485700a0-98b6-2fe0-fbab-bc789b59dca9@2ndquadrant.com/
Also on:    postgresql.org/message-id/485700a0-98b6-2fe0-fbab-bc789b59dca9@2ndquadrant.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: peter.eisentraut@2ndquadrant.com, ah@cybertec.at, bruce@momjian.us, robertmhaas@gmail.com, harada.toshi@po.ntt-tx.co.jp
  Subject: Re: "WIP: Data at rest encryption" patch and, PostgreSQL 11-beta3
  In-Reply-To: <485700a0-98b6-2fe0-fbab-bc789b59dca9@2ndquadrant.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox