[CLUE-Tech] postgres questions on pg_dump and pg_hba.conf security

[David Anselmi]

Jeff Cann wrote:
> Greetings.
> 
> I have my pg_hba.conf file set to password authenticate for a single user into 
> the database used by an application.
> 
[...]
> 
> So, my questions:
> 
> 1)  Anyone have a slick way to crypt and decrypt a password to plain text?  
> I'm thinking that the expect script would read the encrypted password from a 
> file, decrypt it to it's plain text and then pass it into pg_dump.

Don't bother.  Either your secret is on the machine or it isn't. 
crypting it with some other secret that's on the machine doesn't add 
anything.

> 2)  What is the security risk if I loosen my pg_hba.conf file and allow 
> ident/sameuser for this user?

Is the dump running on the db machine or not?  If on the db machine it 
will use the Unix socket to connect to the db.  Identity will be 
determined by the uid (or euid, or something) of the dump process which 
should be good enough.

If it isn't on the same machine then you need an ident server on the 
machine running the dump.  If that machine is secure and you restrict 
access to the db to that machine (think defense in depth) then you 
should be ok.  Hard to say without knowing your environment.

Dave