From 3187ef7c46c5b884267a88f2d6119c9a05f1bbba Mon Sep 17 00:00:00 2001 From: Bruce Momjian Date: Sun, 27 Dec 2020 21:37:42 -0500 Subject: Revert "Add key management system" (978f869b99) & later commits The patch needs test cases, reorganization, and cfbot testing. Technically reverts commits 5c31afc49d..e35b2bad1a (exclusive/inclusive) and 08db7c63f3..ccbe34139b. Reported-by: Tom Lane, Michael Paquier Discussion: https://postgr.es/m/E1ktAAG-0002V2-VB@gemulon.postgresql.org --- doc/src/sgml/config.sgml | 96 +++-------------- doc/src/sgml/database-encryption.sgml | 97 ----------------- doc/src/sgml/filelist.sgml | 1 - doc/src/sgml/installation.sgml | 5 +- doc/src/sgml/postgres.sgml | 1 - doc/src/sgml/ref/allfiles.sgml | 3 +- doc/src/sgml/ref/initdb.sgml | 46 -------- doc/src/sgml/ref/pg_alterckey.sgml | 197 ---------------------------------- doc/src/sgml/ref/pg_ctl-ref.sgml | 14 --- doc/src/sgml/ref/pgupgrade.sgml | 20 +--- doc/src/sgml/ref/postgres-ref.sgml | 13 --- doc/src/sgml/reference.sgml | 1 - doc/src/sgml/storage.sgml | 5 - 13 files changed, 20 insertions(+), 479 deletions(-) delete mode 100644 doc/src/sgml/database-encryption.sgml delete mode 100644 doc/src/sgml/ref/pg_alterckey.sgml (limited to 'doc/src') diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 4d6a0edd91d..4b60382778f 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1452,18 +1452,18 @@ include_dir 'conf.d' mechanism is used. - The command must print the passphrase to the standard output - and exit with code 0. It can prompt from the terminal if - is used. In the parameter value, - %R represents the file descriptor number opened - to the terminal that started the server. A file descriptor is only - available if enabled at server start. If %R - is used and no file descriptor is available, the server will not - start. Value %p is replaced by a pre-defined - prompt string. (Write %% for a literal - %.) Note that the prompt string will probably - contain whitespace, so be sure to quote its use adequately. - Newlines are stripped from the end of the output if present. + The command must print the passphrase to the standard output and exit + with code 0. In the parameter value, %p is + replaced by a prompt string. (Write %% for a + literal %.) Note that the prompt string will + probably contain whitespace, so be sure to quote adequately. A single + newline is stripped from the end of the output if present. + + + The command does not actually have to prompt the user for a + passphrase. It can read it from a file, obtain it from a keychain + facility, or similar. It is up to the user to make sure the chosen + mechanism is adequately secure. This parameter can only be set in the postgresql.conf @@ -1486,12 +1486,10 @@ include_dir 'conf.d' parameter is off (the default), then ssl_passphrase_command will be ignored during a reload and the SSL configuration will not be reloaded if a passphrase - is needed. This setting is appropriate for a command that requires a - terminal for prompting, which will likely not be available when the server is - running. ( closes the terminal file - descriptor soon after server start.) Setting this parameter on - might be appropriate, for example, if the passphrase is obtained - from a file. + is needed. That setting is appropriate for a command that requires a + TTY for prompting, which might not be available when the server is + running. Setting this parameter to on might be appropriate if the + passphrase is obtained from a file, for example. This parameter can only be set in the postgresql.conf @@ -7818,52 +7816,6 @@ COPY postgres_log FROM '/full/path/to/logfile.csv' WITH csv; - - Cluster File Encryption - - - - cluster_key_command (string) - - cluster_key_command configuration parameter - - - - - This option specifies an external command to obtain the cluster-level - key for cluster file encryption during server initialization and - server start. - - - The command must print the cluster key to the standard output as - 64 hexadecimal characters, and exit with code 0. The command - can prompt for the passphrase or PIN from the terminal if - is used. In the parameter value, - %R represents the file descriptor number opened - to the terminal that started the server. A file descriptor is only - available if enabled at server start. If %R - is used and no file descriptor is available, the server will not - start. Value %p is replaced by a pre-defined - prompt string. Value %d is replaced by the - directory containing the keys; this is useful if the command - must create files with the keys, e.g., to store a cluster-level - key encryped by a key stored in a hardware security module. - (Write %% for a literal %.) - Note that the prompt string will probably contain whitespace, - so be sure to quote its use adequately. Newlines are stripped - from the end of the output if present. - - - This parameter can only be set by - initdb, in the - postgresql.conf file, or on the server - command line. - - - - - - Client Connection Defaults @@ -9685,22 +9637,6 @@ dynamic_library_path = 'C:\tools\postgresql;H:\my_project\lib;$libdir' - - file_encryption_keylen (boolean) - - Cluster file encryption key length - - - - - Reports the bit length of the cluster file - encryption key, or zero if disabled. See for more - information. - - - - data_directory_mode (integer) diff --git a/doc/src/sgml/database-encryption.sgml b/doc/src/sgml/database-encryption.sgml deleted file mode 100644 index 82bc137a61f..00000000000 --- a/doc/src/sgml/database-encryption.sgml +++ /dev/null @@ -1,97 +0,0 @@ - - - - Cluster File Encryption - - - Cluster File Encryption - - - - The purpose of cluster file encryption is to prevent users with read - access to the directories used to store database files and write-ahead - log from being able to access the data stored in those files. - For example, when using cluster file encryption, users who have read - access to the cluster directories for backup purposes will not be able - to decrypt the data stored in these files. - - - - Cluster file encryption uses two levels of encryption. The first level - is data encryption keys, specifically keys zero and one. Key zero is - the key used to encrypt database heap and index files which are stored in - the file system, plus temporary files created during database operation. - Key one is used to encrypt write-ahead log (WAL) files. Two different - keys are used so that primary and standby servers can use different zero - (heap/index/temp) keys, but the same one (WAL) key, so that these keys - can eventually be rotated by switching the primary to the standby - and then changing the WAL key. - - - - The second level of encryption is a key used to encrypt first-level - keys. This type of key is often referred to as a Key Encryption Key - (KEK). This key is not stored - in the file system, but provided at initdb time and - each time the server is started. This key prevents anyone with access - to the database directories from decrypting the data because they do - not know the second-level key which encrypted the first-level keys - which encrypted the database cluster files. - - - - Initialization - - - Cluster file encryption is enabled when - PostgreSQL is built - with --with-openssl and is specified - during initdb. The cluster key - provided by the - option during initdb and the one generated - by in the - postgresql.conf must match for the database - cluster to start. Note that the cluster key command - passed to initdb must return a key of - 64 hexadecimal characters. For example. - -initdb -D dbname --cluster-key-command='ckey_passphrase.sh' - - - - - - Internals - - - During the initdb process, if - is specified, two data-level - encryption keys are created. These two keys are then encrypted with - the key encryption key (KEK) supplied by the cluster key command before - being stored in the database directory. The key or passphrase that - derives the key must be supplied from the terminal or stored in a - trusted key store, such as key vault software, hardware security module. - - - - If the PostgreSQL server has - been initialized to require a cluster key, each time the - server starts the postgresql.conf - cluster_key_command command will be executed - and the cluster key retrieved. The data encryption keys in the - pg_cryptokeys directory will then be decrypted - using the supplied key and integrity-checked to ensure it - matches the initdb-supplied key. If this check fails, the - server will refuse to start. - - - - The data encryption keys are randomly generated and are 128, 192, - or 256-bits in length. They are encrypted by the key encryption key - (KEK) using Advanced Encryption Standard (AES256) - encryption in Galois/Counter Mode (GCM), which also - provides KEK authentication. - - - diff --git a/doc/src/sgml/filelist.sgml b/doc/src/sgml/filelist.sgml index b96f4ace6cf..38e8aa0bbf9 100644 --- a/doc/src/sgml/filelist.sgml +++ b/doc/src/sgml/filelist.sgml @@ -49,7 +49,6 @@ - diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml index bcc80240498..0ac1cb99999 100644 --- a/doc/src/sgml/installation.sgml +++ b/doc/src/sgml/installation.sgml @@ -976,9 +976,8 @@ build-postgresql: Build with support for SSL (encrypted) - connections and cluster file encryption. This requires the - OpenSSL package to be installed. - configure will check + connections. This requires the OpenSSL + package to be installed. configure will check for the required header files and libraries to make sure that your OpenSSL installation is sufficient before proceeding. diff --git a/doc/src/sgml/postgres.sgml b/doc/src/sgml/postgres.sgml index 0ea7da604b3..730d5fdc348 100644 --- a/doc/src/sgml/postgres.sgml +++ b/doc/src/sgml/postgres.sgml @@ -171,7 +171,6 @@ break is not needed in a wider output rendering. &wal; &logical-replication; &jit; - &database-encryption; ®ress; diff --git a/doc/src/sgml/ref/allfiles.sgml b/doc/src/sgml/ref/allfiles.sgml index 4e9504e11b6..0f0064150c4 100644 --- a/doc/src/sgml/ref/allfiles.sgml +++ b/doc/src/sgml/ref/allfiles.sgml @@ -189,7 +189,6 @@ Complete list of usable sgml source files in this directory. - @@ -216,7 +215,7 @@ Complete list of usable sgml source files in this directory. - + diff --git a/doc/src/sgml/ref/initdb.sgml b/doc/src/sgml/ref/initdb.sgml index d994f407faa..385ac251506 100644 --- a/doc/src/sgml/ref/initdb.sgml +++ b/doc/src/sgml/ref/initdb.sgml @@ -163,17 +163,6 @@ PostgreSQL documentation - - - - - This option specifies an external command to obtain the cluster-level - key for cluster file encryption during server initialization and - server start; see for details. - - - - @@ -234,18 +223,6 @@ PostgreSQL documentation - - - - - - Specifies the number of bits for the file encryption keys. The - default is 128 bits. - - - - @@ -308,17 +285,6 @@ PostgreSQL documentation - - - - - - Allows the command - to prompt for a passphrase or PIN. - - - - @@ -341,18 +307,6 @@ PostgreSQL documentation - - - - - - Copies cluster file encryption keys from another cluster; required - when using pg_upgrade on a cluster - with cluster file encryption enabled. - - - - diff --git a/doc/src/sgml/ref/pg_alterckey.sgml b/doc/src/sgml/ref/pg_alterckey.sgml deleted file mode 100644 index f80946dcc6d..00000000000 --- a/doc/src/sgml/ref/pg_alterckey.sgml +++ /dev/null @@ -1,197 +0,0 @@ - - - - - pg_alterckey - - - - pg_alterckey - 1 - Application - - - - pg_alterckey - alter the PostgreSQL cluster key - - - - - pg_alterckey - - - - - - - - old_cluster_key_command - new_cluster_key_command - - - - - - - - datadir - - - - - - pg_alterckey - - - - - - - - - - - - - - - - - datadir - - - - - - - Description - - pg_alterckey alters the cluster key used - for cluster file encryption. The cluster key is initially set - during . The command can be run while the - server is running or stopped. The new password must be used the next - time the server is started. - - - - Technically, pg_alterckey changes the key - encryption key (KEK) which encrypts the data - encryption keys; it does not change the data encryption keys. It does - this by decrypting each data encryption key using the old_cluster_key_command, - re-encrypting it using the new_cluster_key_command, and - then writes the result back to the cluster directory. - - - - See the documentation for how to define - the old and new passphrase commands. You can use different executables - for these commands, or you can use the same executable with different - arguments to specify retrieval of the old or new key. - - - - When started, pg_alterckey repairs any files that - remain from previous pg_alterckey failures before - altering the cluster key. To perform only the repair task, - use the option. The server will not start - if repair is needed, though a running server is unaffected by an - unrepaired cluster key configuration. - - - - You can specify the data directory on the command line, or use - the environment variable PGDATA. - - - - - Options - - - - - - - - - Allows the and - commands - to prompt for a passphrase or PIN. - - - - - - - - Other options: - - - - - - - - Print the pg_alterckey version and exit. - - - - - - - - - - Show help about pg_alterckey command line - arguments, and exit. - - - - - - - - - - - Environment - - - - PGDATA - - - - Default data directory location - - - - - - PG_COLOR - - - Specifies whether to use color in diagnostic messages. Possible values - are always, auto and - never. - - - - - - - - See Also - - - - - - - diff --git a/doc/src/sgml/ref/pg_ctl-ref.sgml b/doc/src/sgml/ref/pg_ctl-ref.sgml index 0662ae051a3..3946fa52eab 100644 --- a/doc/src/sgml/ref/pg_ctl-ref.sgml +++ b/doc/src/sgml/ref/pg_ctl-ref.sgml @@ -38,7 +38,6 @@ PostgreSQL documentation options path - @@ -73,7 +72,6 @@ PostgreSQL documentation seconds options - @@ -375,18 +373,6 @@ PostgreSQL documentation - - - - - - Allows or - to prompt for a passphrase - or PIN. - - - - diff --git a/doc/src/sgml/ref/pgupgrade.sgml b/doc/src/sgml/ref/pgupgrade.sgml index b1bcdb77a30..92e1d09a55c 100644 --- a/doc/src/sgml/ref/pgupgrade.sgml +++ b/doc/src/sgml/ref/pgupgrade.sgml @@ -167,15 +167,6 @@ PostgreSQL documentation - - - - allows or - to prompt for a passphrase - or PIN. - - - dir dir @@ -318,9 +309,7 @@ make prefix=/usr/local/pgsql.new install Again, use compatible initdb flags that match the old cluster. Many prebuilt installers do this step automatically. There is no need to - start the new cluster. If upgrading a cluster that uses - cluster file encryption, the initdb option - must be specified. + start the new cluster. @@ -849,13 +838,6 @@ psql --username=postgres --file=script.sql postgres is down. - - If the old cluster uses file encryption, the new cluster must use - the same keys, so pg_upgrade copies them to the - new cluster. It is necessary to initialize the new cluster with - the same cluster_key_command and the same - file encryption key length. - diff --git a/doc/src/sgml/ref/postgres-ref.sgml b/doc/src/sgml/ref/postgres-ref.sgml index 805da81e073..4aaa7abe1a2 100644 --- a/doc/src/sgml/ref/postgres-ref.sgml +++ b/doc/src/sgml/ref/postgres-ref.sgml @@ -297,19 +297,6 @@ PostgreSQL documentation - - - - - Makes postgres prompt for a passphrase or PIN - from the specified open numeric file descriptor. The descriptor - is closed after the key is read. The file descriptor number - -1 duplicates standard error for the terminal; - this is useful for single-user mode. - - - - diff --git a/doc/src/sgml/reference.sgml b/doc/src/sgml/reference.sgml index fdb4e65144b..dd2bddab8c4 100644 --- a/doc/src/sgml/reference.sgml +++ b/doc/src/sgml/reference.sgml @@ -240,7 +240,6 @@ - &pgalterckey; &clusterdb; &createdb; &createuser; diff --git a/doc/src/sgml/storage.sgml b/doc/src/sgml/storage.sgml index cdbc214a510..3234adb639f 100644 --- a/doc/src/sgml/storage.sgml +++ b/doc/src/sgml/storage.sgml @@ -77,11 +77,6 @@ Item Subdirectory containing transaction commit timestamp data - - pg_cryptokeys - Subdirectory containing file encryption keys - - pg_dynshmem Subdirectory containing files used by the dynamic shared memory -- cgit v1.2.3