Have an encrypted pgpass file

From: Marco van Eck <marco(dot)vaneck(at)gmail(dot)com>
To: pgsql-hackers(at)postgresql(dot)org
Subject: Have an encrypted pgpass file
Date: 2018-07-18 17:46:26
Message-ID: CAE35ztOGZqgwae3mBA=L97pSg3kvin2xycQh=ir=5NiwCApiYQ@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

Since .pgpass files contain plain-text passwords, I searched for an
alternative.
In the attached patch I've added the possibility to run a command to
produce the content of the pgpass file, in exactly the same format. In this
way I could use gpg or any other command to decrypt a pgpass file. It will
prefer the .pgpass file and will not call the command.

This would be my environment variable, to have no plain-text password:
PGPASSCOMMAND="gpg -q -d pgpass.gpg"

Other usages of the variable:
PGPASSCOMMAND="cat pgpass"
PGPASSCOMMAND="curl http://passwords/really-unsecure-pgpass"
PGPASSCOMMAND="my-own-secure-pgpass-script"

The submitted patch does it's job, though the command could throw errors.

What do you think of this solution?

Best regards,
Marco van Eck

Attachment Content-Type Size
pgpasscommand_v1.patch application/octet-stream 6.0 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Tom Lane 2018-07-18 18:05:17 Re: ENOSPC FailedAssertion("!(RefCountErrors == 0)"
Previous Message Robert Haas 2018-07-18 17:03:20 Re: ENOSPC FailedAssertion("!(RefCountErrors == 0)"