4

I am reading the postgresql database documentation, but I can't found nothing about encrypting the database files to prevent someone to see the data without the database password. There is some way to make postgresql safe if someone, for example, get physical access to the server?

I know that Linux can encrypt the partition as said in the documentation, but that is not what I am looking for.

4
  • If someone gets access as some user then filesystem permissions should be enough to stop him (plus reviewing PAM maybe). If someone gets root access you're screwed in 99.9% percent of cases since even with encrypted partitions he can read the key from memory.
    – grochmal
    Aug 29, 2016 at 20:08
  • No i mean suppose someone gets the server computer in his house... how can i prevent this user from getting server data. The partition encryption is not enought, because the machine will boot normally. For example a rar protected file only will open if you have the password, why not the same with databases? Only will open if you have the password! Because it can be the key for opening the data! I know databases can have a lot of passwords, so why not solve this, by creating keys for the users encrypted for each password and inside it, a master key that can open the database? Aug 29, 2016 at 20:12
  • By the contrary. For that attack vector (physical access) full disk encryption is the answer. You not only need to encrypt the database files but also /tmp, /run and most importantly the swap. Otherwise someone can simply read the data from swap. A machine with full disk encryption will not boot unless given the correct password to mount the filesystems.
    – grochmal
    Aug 29, 2016 at 20:18
  • I already have the disk encryption thank you for the help. Aug 29, 2016 at 20:18

1 Answer 1

4

To protect your data against physical access to the server, you need to move the encryption/decryption at least partially off the server. If your server can boot and mount its encrypted partitions without external help, then it's vulnerable.

If you only care about physical removal, involving a reboot of the server, then disk encryption might be sufficient, if the encryption key is stored off the server; for example, using network encryption (a key unlocking server somewhere else on the network, for example Tang and Clevis), or as grochmal suggested, a key entered manually at boot (but in the latter case your server won't boot unattended, which could be a significant inconvenience).

If you care about physical access in general, then you should perform the encryption and decryption using information stored on the clients, for example using pgcrypto, or even performing encryption and decryption solely on the clients, coded in your client application. In these cases though the encrypted data is no longer usable in queries, unless you implement homomorphic encryption. There are quite a few subtleties involved, for example with data representation (NULL values in particular), so you should probably talk to a security expert (without re-inventing the wheel...).

1
  • Thank you very much, this is a very very nice explanation! God bless you! Thanks! Aug 30, 2016 at 12:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .