Securing PostgreSQL [pdf]

#1

Post by okket » Thu, Nov 03, 2016, 2:50 PM UTC

Re: Securing PostgreSQL [pdf]

#2

Post by tzaman » Thu, Nov 03, 2016, 4:03 PM UTC

So true, which is why I find it kind of awkward when I say to young developers/business owners they should pay for a professional PostgreSQL hosting and they argue it's open source and they can host their DBs on a $25 (or less) Digital Ocean instance.

Until it's too late, I guess.

Re: Securing PostgreSQL [pdf]

#3

Post by altendo » Thu, Nov 03, 2016, 4:14 PM UTC

While there is some PostgreSQL-specific things in this, the vast majority of it is pretty solid advice regardless of the database you have.

Re: Securing PostgreSQL [pdf]

#4

Post by cygned » Thu, Nov 03, 2016, 4:28 PM UTC

Awesome! Is the actual talk somewhere as a video?

Re: Securing PostgreSQL [pdf]

#5

Post by esseti » Thu, Nov 03, 2016, 4:36 PM UTC

The problem with pgcrypto is the fact that in the logs there's the password? that's it? I would like to see the talk to get a better understainding of the whole message, is it available somewhere?

Re: Securing PostgreSQL [pdf]

#6

Post by brian_cloutier » Thu, Nov 03, 2016, 5:02 PM UTC

cygned wrote: post #4

Awesome! Is the actual talk somewhere as a video?

These slides are from a talk given today at pgconfeu, unfortunately no videos were taken.

Re: Securing PostgreSQL [pdf]

#7

Post by craigkerstiens » Thu, Nov 03, 2016, 5:15 PM UTC

cygned wrote: post #4

Awesome! Is the actual talk somewhere as a video?

The same talk is actually being given at PGConf Silicon Valley in just under 2 weeks (http://www.pgconfsv.com/program). We will be recording the audio and slides there and that video will be online some weeks after. You could also always come and see it live if you're in the bay area :)

Re: Securing PostgreSQL [pdf]

#8

Post by CodeWriter23 » Thu, Nov 03, 2016, 5:27 PM UTC

esseti wrote: post #5

The problem with pgcrypto is the fact that in the logs there's the password? that's it? I would like to see the talk to get a better understainding of the whole message, is it available somewhere?

No the issue is statement logging can be turned on at any time and when it is on, everything you are encrypting is revealed in plaintext in the log.

Re: Securing PostgreSQL [pdf]

#9

Post by mmerickel » Thu, Nov 03, 2016, 5:35 PM UTC

esseti wrote: post #5

The problem with pgcrypto is the fact that in the logs there's the password? that's it? I would like to see the talk to get a better understainding of the whole message, is it available somewhere?

The fundamental issue is that you should not be exposing the encryption keys to the database. If you're using pgcrypto then you're issuing SQL statements in the database with the key. You should do your encryption client-side so that the key is never passed over the wire at all.

Re: Securing PostgreSQL [pdf]

#10

Post by cygned » Thu, Nov 03, 2016, 5:36 PM UTC

craigkerstiens wrote: post #7

cygned wrote: post #4

Awesome! Is the actual talk somewhere as a video?

The same talk is actually being given at PGConf Silicon Valley in just under 2 weeks ( http://www.pgconfsv.com/program ). We will be recording the audio and slides there and that video will be online some weeks after. You could also always come and see it live if you're in the bay area :)

Too sad, Germany is a bit too far away. However, thanks in advance for recording, looking forward to watching it!