index 426928f6800332460388fb3e92a762ee8aad45fd..4d6a0edd91d88140ac55a1989a2f1f0eacb945e4 100644 (file)
mechanism is used.
</para>
<para>
- The command must print the passphrase to the standard output and exit
- with code 0. In the parameter value, <literal>%p</literal> is
- replaced by a prompt string. (Write <literal>%%</literal> for a
- literal <literal>%</literal>.) Note that the prompt string will
- probably contain whitespace, so be sure to quote adequately. A single
- newline is stripped from the end of the output if present.
- </para>
- <para>
- The command does not actually have to prompt the user for a
- passphrase. It can read it from a file, obtain it from a keychain
- facility, or similar. It is up to the user to make sure the chosen
- mechanism is adequately secure.
+ The command must print the passphrase to the standard output
+ and exit with code 0. It can prompt from the terminal if
+ <option>--authprompt</option> is used. In the parameter value,
+ <literal>%R</literal> represents the file descriptor number opened
+ to the terminal that started the server. A file descriptor is only
+ available if enabled at server start. If <literal>%R</literal>
+ is used and no file descriptor is available, the server will not
+ start. Value <literal>%p</literal> is replaced by a pre-defined
+ prompt string. (Write <literal>%%</literal> for a literal
+ <literal>%</literal>.) Note that the prompt string will probably
+ contain whitespace, so be sure to quote its use adequately.
+ Newlines are stripped from the end of the output if present.
</para>
<para>
This parameter can only be set in the <filename>postgresql.conf</filename>
parameter is off (the default), then
<varname>ssl_passphrase_command</varname> will be ignored during a
reload and the SSL configuration will not be reloaded if a passphrase
- is needed. That setting is appropriate for a command that requires a
- TTY for prompting, which might not be available when the server is
- running. Setting this parameter to on might be appropriate if the
- passphrase is obtained from a file, for example.
+ is needed. This setting is appropriate for a command that requires a
+ terminal for prompting, which will likely not be available when the server is
+ running. (<option>--authprompt</option> closes the terminal file
+ descriptor soon after server start.) Setting this parameter on
+ might be appropriate, for example, if the passphrase is obtained
+ from a file.
</para>
<para>
This parameter can only be set in the <filename>postgresql.conf</filename>
index 94cdf4c8874dac5935981a094a4768d4fb3c0e60..1b712cfbba365c29532333f8c014cbff1947d887 100644 (file)
#include <sys/stat.h>
#include <unistd.h>
+#include "postmaster/postmaster.h"
#include "common/string.h"
#include "libpq/libpq.h"
#include "storage/fd.h"
@@ -61,6 +62,19 @@ run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf,
appendStringInfoString(&command, prompt);
p++;
break;
+ case 'R':
+ {
+ char fd_str[20];
+
+ if (terminal_fd == -1)
+ ereport(ERROR,
+ (errcode(ERRCODE_INTERNAL_ERROR),
+ errmsg("ssl_passphrase_command referenced %%R, but -R not specified")));
+ p++;
+ snprintf(fd_str, sizeof(fd_str), "%d", terminal_fd);
+ appendStringInfoString(&command, fd_str);
+ break;
+ }
case '%':
appendStringInfoChar(&command, '%');
p++;