2 added 39 characters in body
source | link

So I'm simply asking, how strong would my (super user) database credentials ideally be?

In this context I find it more relevant to how you manage your passwords and secrets. You should ideally set an as strong (and unique) passphrase as possible. With that said, you can reach a high level of entropy by just concatinating words together. In this context I find it more relevant to how you manage your passwords and secrets. You should ideally set an as strong (and unique) passphrase as possible. With that said, you can reach a high level of entropy by just concatinating words together.

...use it hard-coded in my script files as a password?

That is a viable solution if you make sure that there is unique accounts (not superuser) to your individual scripts, with the principle of least privilege. You should not give more privileges than needed for your scripts to run without permission constraints.

What is really important here is to ensure that they are protected properly if stored in a repository for instance. I'd look at StackExchange's blackbox[1], or vault[2] from Hashicorp. That is a viable solution if you make sure that there is unique accounts (not superuser) to your individual scripts, with the principle of least privilege. You should not give more privileges than needed for your scripts to run without permission constraints.

[1] What is really important here is to ensure that they are protected properly if stored in a repository for instance. I'd look at StackExchange's https://github.com/StackExchange/blackbox

[2], or https://www.vaultproject.io/vault from Hashicorp.

Using the same password seems dangerous if my concern is hackers.

IFIf you can implement 2-factor authentication for your superuser, any other accounts intended for manual access this becomes less of a concern. This would mitigate many, if not all of the attack vectors you're concerned about. I haven't done this myself for PostgreSQL in particular but there is some write-ups on it online.you can implement 2-factor authentication for your superuser, any other accounts intended for manual access this becomes less of a concern. This would mitigate many, if not all of the attack vectors you're concerned about. I haven't done this myself for PostgreSQL in particular but there is some write-ups on it online.

See: https://theplateisbad.blogspot.com/2016/12/one"One-time-passwords-with-google.html passwords with Google Authenticator PAM (and friends)".

So I'm simply asking, how strong would my (super user) database credentials ideally be?

In this context I find it more relevant to how you manage your passwords and secrets. You should ideally set an as strong (and unique) passphrase as possible. With that said, you can reach a high level of entropy by just concatinating words together.

...use it hard-coded in my script files as a password?

That is a viable solution if you make sure that there is unique accounts (not superuser) to your individual scripts, with the principle of least privilege. You should not give more privileges than needed for your scripts to run without permission constraints.

What is really important here is to ensure that they are protected properly if stored in a repository for instance. I'd look at StackExchange's blackbox[1], or vault[2] from Hashicorp.

[1] https://github.com/StackExchange/blackbox

[2] https://www.vaultproject.io/

Using the same password seems dangerous if my concern is hackers.

IF you can implement 2-factor authentication for your superuser, any other accounts intended for manual access this becomes less of a concern. This would mitigate many, if not all of the attack vectors you're concerned about. I haven't done this myself for PostgreSQL in particular but there is some write-ups on it online.

See: https://theplateisbad.blogspot.com/2016/12/one-time-passwords-with-google.html

So I'm simply asking, how strong would my (super user) database credentials ideally be?

In this context I find it more relevant to how you manage your passwords and secrets. You should ideally set an as strong (and unique) passphrase as possible. With that said, you can reach a high level of entropy by just concatinating words together.

...use it hard-coded in my script files as a password?

That is a viable solution if you make sure that there is unique accounts (not superuser) to your individual scripts, with the principle of least privilege. You should not give more privileges than needed for your scripts to run without permission constraints.

What is really important here is to ensure that they are protected properly if stored in a repository for instance. I'd look at StackExchange's blackbox, or vault from Hashicorp.

Using the same password seems dangerous if my concern is hackers.

If you can implement 2-factor authentication for your superuser, any other accounts intended for manual access this becomes less of a concern. This would mitigate many, if not all of the attack vectors you're concerned about. I haven't done this myself for PostgreSQL in particular but there is some write-ups on it online.

See "One-time passwords with Google Authenticator PAM (and friends)".

1
source | link

So I'm simply asking, how strong would my (super user) database credentials ideally be?

In this context I find it more relevant to how you manage your passwords and secrets. You should ideally set an as strong (and unique) passphrase as possible. With that said, you can reach a high level of entropy by just concatinating words together.

...use it hard-coded in my script files as a password?

That is a viable solution if you make sure that there is unique accounts (not superuser) to your individual scripts, with the principle of least privilege. You should not give more privileges than needed for your scripts to run without permission constraints.

What is really important here is to ensure that they are protected properly if stored in a repository for instance. I'd look at StackExchange's blackbox[1], or vault[2] from Hashicorp.

[1] https://github.com/StackExchange/blackbox

[2] https://www.vaultproject.io/

Using the same password seems dangerous if my concern is hackers.

IF you can implement 2-factor authentication for your superuser, any other accounts intended for manual access this becomes less of a concern. This would mitigate many, if not all of the attack vectors you're concerned about. I haven't done this myself for PostgreSQL in particular but there is some write-ups on it online.

See: https://theplateisbad.blogspot.com/2016/12/one-time-passwords-with-google.html