pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Stephen Frost <sfrost@snowman.net>
Cc: Bruce Momjian <bruce@momjian.us>
Cc: Ants Aasma <ants.aasma@eesti.ee>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: WIP: Data at rest encryption
Date: Wed, 14 Jun 2017 17:36:16 -0400
Message-ID: <9cea5160-c64b-0b9e-d4b7-c57db2a696be@2ndquadrant.com> (raw)
In-Reply-To: <20170613221104.GT3151@tamriel.snowman.net>
References: <20170613170132.GH3151@tamriel.snowman.net>
	<20170613171356.GG13873@momjian.us>
	<20170613172459.GL3151@tamriel.snowman.net>
	<20170613174329.GK13873@momjian.us>
	<20170613182339.GP3151@tamriel.snowman.net>
	<20170613182910.GN13873@momjian.us>
	<20170613183858.GR3151@tamriel.snowman.net>
	<20170613185622.GO13873@momjian.us>
	<20170613192011.GS3151@tamriel.snowman.net>
	<a2fa2930-5334-c926-01ee-4a01c605b7a4@2ndquadrant.com>
	<20170613221104.GT3151@tamriel.snowman.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

On 6/13/17 18:11, Stephen Frost wrote:
>> Let's see a proposal in those terms then.  How easy can you make it,
>> compared to existing OS-level solutions, and will that justify the
>> maintenance overhead?
> From the original post on this thread, which included a WIP patch:
> 
> ----------------------------------
> Usage
> =====
> 
> Set up database like so:
> 
>     (read -sp "Postgres passphrase: " PGENCRYPTIONKEY; echo;
>      export PGENCRYPTIONKEY
>      initdb -k -K pgcrypto $PGDATA )
> 
> Start PostgreSQL:
> 
>     (read -sp "Postgres passphrase: " PGENCRYPTIONKEY; echo;
>      export PGENCRYPTIONKEY
>      postgres $PGDATA )
> ----------------------------------

Relying on environment variables is clearly pretty crappy.  So if that's
the proposal, then I think it needs to be better.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (93+ messages)  latest in thread

Message-ID: <9cea5160-c64b-0b9e-d4b7-c57db2a696be@2ndquadrant.com>
Permalink:  ../9cea5160-c64b-0b9e-d4b7-c57db2a696be@2ndquadrant.com/
Also on:    postgresql.org/message-id/9cea5160-c64b-0b9e-d4b7-c57db2a696be@2ndquadrant.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: peter.eisentraut@2ndquadrant.com, sfrost@snowman.net, bruce@momjian.us, ants.aasma@eesti.ee, robertmhaas@gmail.com
  Subject: Re: WIP: Data at rest encryption
  In-Reply-To: <9cea5160-c64b-0b9e-d4b7-c57db2a696be@2ndquadrant.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox