Subject: Re: [SQL] encrypt psql password in unix script
To: pgsql-general@postgresql.org
References: 
 <CAJP7dtBTkFiF4h6E9jWKToBjRrRmVNWrEan5EmpGK+oBvt_4sQ@mail.gmail.com>
 <CAJexoSKSz75caNVyYHdONYsjKYHCAN_ONknO6X7fOr8CVQfgNA@mail.gmail.com>
From: John R Pierce <pierce@hogranch.com>
Message-ID: <559D7805.3050909@hogranch.com>
Date: Wed, 8 Jul 2015 12:20:37 -0700
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.0.1
MIME-Version: 1.0
In-Reply-To: 
 <CAJexoSKSz75caNVyYHdONYsjKYHCAN_ONknO6X7fOr8CVQfgNA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-general-owner@postgresql.org

On 7/8/2015 12:01 PM, Steve Midgley wrote:
> My suggestion is to put it in an environment variable and set that 
> variable from a shell startup script that is secured with permissions. 
> (http://www.postgresql.org/docs/9.4/static/libpq-envars.html)
>

that just moves the problem, now the plaintext password is in a script 
file somewhere, AND many OS's let other users see your environment.

> If you can't do that, the only other method I've used is to setup 
> Postgres with Ansible, and store the Pg passwords in an ansible vault, 
> which is encrypted. Ansible asks for the decrypt key when it runs.
>

how would that work for unattended scripts, such as cron jobs ?


-- 
john r pierce, recycling bits in santa cruz


-- 
Sent via pgsql-general mailing list (pgsql-general@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-general