/tmp/telemedia_newdb\""% (HOST_SOURCE_DB_UPASS,HOST_" name="description" /> /tmp/telemedia_newdb\""% (HOST_SOURCE_DB_UPASS,HOST_" />
14897

fabric postgres password in command

Question:

I have a fabric script that dumps database on server. And I can use it on multiple servers with the PostgreSQL database. The command is simple:

sudo("su postgres -c \"PGPASSWORD=%s pg_dump %s > /tmp/telemedia_newdb\"" % (HOST_SOURCE_DB_UPASS,HOST_SOURCE_DB))

But sometimes, Postgres does not ask for a password at all ...

Will this command fail without a password prompting from Postgres? (Or I know that it will not prompt and HOST_SOURCE_DB_UPASS=''). I want THIS code to work with or without password.

Answer1:

It all depends on how you set up access to your database in pg_hba.conf. There is a separate config file per database cluster (effectively per port) and settings can be different from database to database.

So, yes, if you have set it up that way, then the system user postgres will have password-less access to some databases but is prompted to enter a password for others. The <strong>default</strong> is that the system user postgres has password-less access to every database as database user of the same name (postgres).

If you provide a password in the command with the <a href="http://www.postgresql.org/docs/current/interactive/libpq-envars.html" rel="nofollow">environment variable PGPASSWORD</a>, but no password is needed, it will be ignored silently.

However, I quote the <a href="http://www.postgresql.org/docs/current/interactive/libpq-envars.html" rel="nofollow">manual here</a>:

<blockquote>

PGPASSWORD (...) Use of this environment variable is not recommended for security reasons.

</blockquote>

You can use a <a href="http://www.postgresql.org/docs/9.1/static/libpq-pgpass.html" rel="nofollow">password file</a> to provide passwords automatically (.pgpass on Unix systems). pg_dump will use it.

Finally, consider the <a href="http://www.postgresql.org/docs/9.1/static/app-pgdump.html" rel="nofollow">command line options</a>:

--no-password --password

to force pg_dump to either prompt or not prompt for a password. If a password is required but disabled by --no-password, pg_dump will fail.

<hr />

I would enable <strong>password-less access</strong> for the system user postgres to every database in the config file pg_hba.conf. Use peer or ident <a href="http://www.postgresql.org/docs/9.1/static/auth-methods.html#AUTH-IDENT" rel="nofollow">authentication methods</a>. Then you don't have to provide a password and the script will always work:

local all postgres ident

Your script would be simplified to (untested):

sudo("su postgres -c \"pg_dump %s > /tmp/telemedia_newdb\"" % (HOST_SOURCE_DB))

Recommend

  • OWIN Authentication with Google
  • Capitalize a substring within a string
  • Device still has the old apk
  • Geo Fix not working in Android SDK 2.2
  • Django Migrations fail during django initialization
  • mysql table locked after php crashes
  • PostgreSQL 9.x - pg_read_binary_file & inserting files into bytea
  • How do you keep a running instance for Google App Engine
  • ASP.NET windows authentication should always ask for credentials
  • Changing Jupyter Notebook start up folder by modifying “start in” not working any more
  • How to skip require in ruby?
  • VBA Excel, loop through variables
  • converter json to two dimensional array
  • Tell Git to stop prompting me for conflicts when none really exist?
  • OOP Javascript - Is “get property” method necessary?
  • PostgreSQL Query without WHERE only ORDER BY and LIMIT doesn't use index
  • Illegal mix of collations for operation for date/time comparison
  • Date difference with leap year
  • angularjs unit test when to use $rootScope.$new()
  • Volusion's generic SQL folder, functionality
  • Menu Color Fade on Hover with Jquery
  • How to limit post in wp_query
  • Hazelcast - OperationTimeoutException
  • How to make Safari send if-modified-since header?
  • Adding custom controls to a full screen movie
  • R: gsub and capture
  • jqPlot EnhancedLegendRenderer plugin does not toggle series for Pie charts
  • Comma separated Values
  • Acquiring multiple attributes from .xml file in c#
  • How to set the response of a form post action to a iframe source?
  • How do you join a server to an Active Directory (domain)?
  • How to CLICK on IE download dialog box i.e.(Open, Save, Save As…)
  • Change div Background jquery
  • Qt: Run a script BEFORE make
  • Authorize attributes not working in MVC 4
  • How can I remove ASP.NET Designer.cs files?
  • reshape alternating columns in less time and using less memory
  • UserPrincipal.Current returns apppool on IIS
  • java string with new operator and a literal
  • How to load view controller without button in storyboard?