From: | Stephen Frost <sfrost(at)snowman(dot)net> |
---|---|
To: | Ron <ronljohnsonjr(at)gmail(dot)com> |
Cc: | pgsql-general <pgsql-general(at)postgresql(dot)org> |
Subject: | Re: pgbackrest - hiding the encryption password |
Date: | 2021-05-19 18:33:25 |
Message-ID: | 20210519183325.GM20766@tamriel.snowman.net |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-general |
Greetings,
* Ron (ronljohnsonjr(at)gmail(dot)com) wrote:
> Currently on our RHEL 7.8 system, /etc/pgbackrest.conf is root:root and 633
> perms. Normally, that's ok, but is a horrible idea when it's a plaintext
> file, and stores the pgbackrest encryption password.
>
> Would pgbackrest (or something else) break if I change it to
> postgres:postgres 600 perms?
As long as it can be read by the user performing backups/restores and
archive-push/archive-get, it should be fine.
> Is there a better way of hiding the password so that only user postgres can
> see it?
This is a bit like asking how to 'hide' the encrypted private key for
SSL/TLS. Anywhere you hide it, if you want things to actually work in
an automated fashion, is also going to need to be available all the
time.. In particular, archive-push gets run a lot and you don't want
that to fail or to wait for someone to provide an encryption key.
Thanks,
Stephen
From | Date | Subject | |
---|---|---|---|
Next Message | atirek khare | 2021-05-19 18:33:27 | Question: pgp_sym_decrypt/pgp_sym_encrypt |
Previous Message | David Steele | 2021-05-19 18:27:38 | Re: pgbackrest info of encrypted seems broken |