Subject: Re: encrypt psql password in unix script
To: pgsql-general@postgresql.org
References: 
 <CAJP7dtBTkFiF4h6E9jWKToBjRrRmVNWrEan5EmpGK+oBvt_4sQ@mail.gmail.com>
From: John R Pierce <pierce@hogranch.com>
Message-ID: <559D6FFF.5070903@hogranch.com>
Date: Wed, 8 Jul 2015 11:46:23 -0700
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.0.1
MIME-Version: 1.0
In-Reply-To: 
 <CAJP7dtBTkFiF4h6E9jWKToBjRrRmVNWrEan5EmpGK+oBvt_4sQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-general-owner@postgresql.org

On 7/8/2015 11:34 AM, Suresh Raja wrote:
> I cannot use .pgpass as the password stored here is not encrypted.
>
> can i use a encrypted password from unix shell script.  has anybody 
> ran into same situation. Wht options do i have.

I believe anywhere you enter a password in postgres, it can be the hash 
instead.

but what security does that gain you?    if someone gets your 
encrypted/hashed password, he can still log on.   the pgpass file has to 
be permissions 700, so only YOU (and root) can read it.

if these are LOCAL connections to a pg server on the same machine, you 
can use 'ident' as your authentication, where your unix user is used as 
the postgres username.   or, you can use ssl certificates for 
authentication, this is more complex to setup.


-- 
john r pierce, recycling bits in santa cruz


-- 
Sent via pgsql-general mailing list (pgsql-general@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-general