Мне тут задали вопросик - I've just

Question

Мне тут задали вопросик - I've just

been asked to modify, for privacy reasons, an existing application based on PostgreSQL as follows:
Host A: holds the application and is trusted
Host B: holds the (Postgres) database. Nobody with access to host B, including local system administrators, is allowed to gain access to any data stored in the DB.
While Oracle and MSSQL support transparent data encryption, which I'd consider a 99% solution to the problem, Postgres does not.
An encrypted filesystem will not be sufficient for the use case.
I already looked into pgcrypto, but this seems to give me not much of an advantage compared to encrypting directly within the application, in terms of implementation effort. In any case, I'd have to modify the application's database abstraction and/or ORM.
Maybe you have an idea about how to avoid changes in the application, eventually even an existing extension or tool (like some kind of transparent proxy)?

#backend #devops #pgsql #programming #russian

0

22.06.2017

1 ответов

7 просмотров

blkmrkt · Accepted Answer

blkmrkt

Интересно, а как он собирается от локального админа защищаться? Достаточно дампнуть память процесса и извлечь ключ

0

22.06.2017

172 похожих чатов

Мне тут задали вопросик - I've just

1 ответов

Похожие вопросы