Re: Regd. the Implementation of Wallet (in Oracle) config equivalent in postgreSQL whilst the database migration

What would you be missing? You can encrypt databases. You can encrypt the
s3 buckets using kms. You can govern access via ssh Auth. When you do
backups, you can encrypt the tar.gz files or whatever format and store it
on s3. Same with the wal files. The fact that oracle charges for this is a
joke. Of course, you would need to ensure compliance with your opsec teams
and stuck with best security practices but it seems top to bottom
encryption is unrelated or tangentially related to the databases.

Also, if you lose the encryption keys for your backups then bad things
happen. I doubt what I did was production viable but I limited database
access to a handful of users, encrypted the disks, left the Wal files
unencrypted but mounted with read access for a single user, compressed full
backups with encryption and a password, generated sah keys for anyone who
needed service accounts to access the systems, enforced database ownership
permissions, and and gave server access to a tiny team with 2fa. The way 8
figured it, if someone somehow rooted the box we were screwed anyway.

For an internal database, this seemed sufficient. For an external database,
I would highly recommend paid consulting security firms or hire people who
know to build an externally facing platform.

Thanks
Ben

On Wed, Dec 21, 2022, 4:39 PM Rainer Duffner <rainer(at)ultra-secure(dot)de> wrote:

>
>
> Am 21.12.2022 um 22:34 schrieb Laurenz Albe <laurenz(dot)albe(at)cybertec(dot)at>:
>
> There is no exact equivalent, but there is something similar and much
> better: you can
> authenticate the client with SSL client certificates:
> https://www.postgresql.org/docs/current/auth-cert.html
>
>
>
> Isn’t the wallet the part where the encryption keys are stored?
>
> Indeed, one of the few remaining features that only Oracle (and of course
> other commercial RDMSs) has seems to be full HSM support for TDE.
>
>
> Rainer
>