Re: Regd. the Implementation of Wallet (in Oracle) config equivalent in postgreSQL whilst the database migration

Ron <ronljohnsonjr@xxxxxxxxx> · Wed, 21 Dec 2022 17:10:00 -0600



    If a hacker gets in with root access, they can copy your
    (and my) Postgresql database files (or, more easily, the backup
    files) off site, restore them, and then have access to your
    database.  Not so much TDE-encrypted databases, since the backups
    are encrypted too and you need the key to decrypt them,

    
    As for the Bad Things which happen if you lose the keys... well, don't
      lose the keys!!

    
    On 12/21/22 16:25, Benedict Holland
      wrote:

    
      What would you be missing? You can encrypt
        databases. You can encrypt the s3 buckets using kms. You can
        govern access via ssh Auth. When you do backups, you can encrypt
        the tar.gz files or whatever format and store it on s3. Same
        with the wal files. The fact that oracle charges for this is a
        joke. Of course, you would need to ensure compliance with your
        opsec teams and stuck with best security practices but it seems
        top to bottom encryption is unrelated or tangentially related to
        the databases.
        

        Also, if you lose the encryption keys for your
          backups then bad things happen. I doubt what I did was
          production viable but I limited database access to a handful
          of users, encrypted the disks, left the Wal files unencrypted
          but mounted with read access for a single user, compressed
          full backups with encryption and a password, generated sah
          keys for anyone who needed service accounts to access the
          systems, enforced database ownership permissions, and and gave
          server access to a tiny team with 2fa. The way 8 figured it,
          if someone somehow rooted the box we were screwed anyway.
        

        For an internal database, this seemed
          sufficient. For an external database, I would highly recommend
          paid consulting security firms or hire people who know to
          build an externally facing platform.
        

        Thanks
        Ben
      
      
        On Wed, Dec 21, 2022, 4:39 PM
          Rainer Duffner <rainer@xxxxxxxxxxxxxxx>
          wrote:

        
                Am 21.12.2022 um 22:34 schrieb Laurenz Albe <laurenz.albe@xxxxxxxxxxx>:
                

                There
                    is no exact equivalent, but there is something
                    similar and much better: you can

                  authenticate
                    the client with SSL client certificates:

                  https://www.postgresql.org/docs/current/auth-cert.html
              
            
            Isn’t the wallet the part where the encryption keys are
              stored?
            

            Indeed, one of the few remaining features that only
              Oracle (and of course other commercial RDMSs) has seems to
              be full HSM support for TDE.
            

            Rainer
          
        
    -- 

      Angular momentum makes the world go 'round.