Re: PGPASSWORD - Mailing list pgsql-bugs

Tom Lane wrote:

  postgresbugs <a class="moz-txt-link-rfc2396E"
 href="mailto:postgresbugs@grifent.com"><postgresbugs@grifent.com> writes:


    Unless the utilities like psql and pg_dump are changed to accept a
password as a command line option, I don't think PGPASSWORD should go
away. It is too useful for those that know how to properly use and
destroy environmental variables.



... which evidently does not include you.  The point here is that if
PGPASSWORD is passed down to psql as an environmental variable, it is
visible as part of psql's environment for the entire run of psql.
Whatever the calling script does later doesn't remove that window of
vulnerability.



No need for personal attacks. Just because you disagree is no reason to
be arrogant. I don't want to get into an "urinating match" with you.

And, yes I do understand that for the brief period the environmental
variable could possibly be visible on some platforms, but even Windows
has the local directive which makes the variable far more secure. In my
case, prompting each time for the password is out of the question.
There is no human to answer the prompt.

  There is no intention of removing PGPASSWORD, because it is safe and
useful *on platforms that do not expose other processes' environment
variables*.  But it is deprecated and will remain so, because there
are too many platforms where this is not true.


I thought the word "deprecated"  means there is intent to remove it
from use in the future.



    Again, the advantage is I can let users with no database login have
controlled access to database data and utilities without them actually
having a user name and password to the database. Without the ability to
use PGPASSWORD, I have to expose the password in a .pgpass file for
every user I want to allow access. I think that is far more insecure.



If .pgpass is properly protected, I do not see why you think it is
insecure.  It's certainly a lot safer than environment variables.

            regards, tom lane


The user that starts the program may not have any .pgpass file in their
home directory. The program may even be started remotely. The password
is encrypted and stored and decrypted by the binary and the passed to
the script for execution of the standard Postgres utility. The script
runs in a process that never opens a visible terminal or process that
would be visible to anyone that might even be near the server.

Regards,
John Griffiths