3 ms·
Does anyone know if there's a way to pull secrets into PG from an environment variable or similar and access it within PG in a way that does not directly expose
by cpursley 6y ago
Does anyone know if there's a way to pull secrets into PG from an environment variable or similar and access it within PG in a way that does not directly expose the value to the db user or to logs?
- nix23 6y agoWith pgcrypto? https://x-team.com/blog/storing-secure-passwords-with-postgresql/ https://x-team.com/blog/storing-secure-passwords-with-postgr...
- sk5t 6y agoWon't the advice in that cursory blog post expose the plaintext to query logs? IMHO doing the hashing and password comparison in application code has benefits in both shifting the compute workload to horizontally scalable non-db workers and keeping the plaintext off the wire/queries.
- ants_a 6y agoWhile environment variables are not the most bulletproof place to store secrets, a plpython function will be able to access environment variable via the os module.