On 24 July 2018 at 05:53, Jeff Janes <jeff.ja...@gmail.com> wrote: > On Wed, Jul 18, 2018 at 5:52 PM, Tom Lane <t...@sss.pgh.pa.us> wrote: > >> Thomas Munro <thomas.mu...@enterprisedb.com> writes: >> > On Thu, Jul 19, 2018 at 5:46 AM, Marco van Eck <marco.van...@gmail.com> >> wrote: >> >> Since .pgpass files contain plain-text passwords, I searched for an >> >> alternative. >> >> In the attached patch I've added the possibility to run a command to >> produce >> >> the content of the pgpass file, in exactly the same format. >> >> > ... Here you side step those questions completely and make that the end >> > user's problem. I like it. >> >> ... but doesn't this just encourage people to build hacks that aren't >> really any more secure than the unreadable-file approach? In fact, >> I'm afraid this would be an attractive nuisance, in that people would >> build one-off hacks that get no security vetting and don't really work. >> >> I'd like to see a concrete example of a use-case that really does add >> security; preferably one short and useful enough to put into the docs >> so that people might copy-and-paste it rather than rolling their own. >> It seems possible that something of the sort could be built atop >> ssh-agent or gpg-agent, for instance. >> > > If the goal is not unattended operation but just unannoying operation, I > think the first example he provided is already that use-case. If you > already have gpg configured to use gpg-agent, then it just works. You get > encryption-at-rest, and you don't have to type in your password repeatedly > in the same continuous shell session. >
... and the attacker steals the key from gpg-agent. Grabbing it from a process's memory is a bit harder than grabbing contents of a file, but not much harder. If the agent is remote then that's harder, but you can just ask the script to decrypt the pgpass for you, so again, not much of a win. Even with a hardware crypto offload device the advantage here seems to be mainly limited to making it harder to capture data from backups or file-lifting attacks. Anything that can execute code or commands on the host can still get the credentials. -- Craig Ringer http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Training & Services
