Skip to content

Commit

Permalink
Merge pull request #4147 from EnterpriseDB/docs/tde/removing-ascii-code
Browse files Browse the repository at this point in the history
TDE: replacing ascii code with the correct characters
  • Loading branch information
drothery-edb authored May 26, 2023
2 parents 9d077cc + 078d4d0 commit 3636595
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions product_docs/docs/tde/15/key_stores.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -47,8 +47,8 @@ Key unwrap commands that prompt for passwords on the terminal don't work when th
For example, for systemd, you can use `systemd-ask-password`:

```
PGDATAKEYWRAPCMD="bash -c 'openssl enc -e -aes-128-cbc -pbkdf2 -out %p -pass file:<(sudo systemd-ask-password --no-tty)'"
PGDATAKEYUNWRAPCMD="bash -c 'openssl enc -d -aes-128-cbc -pbkdf2 -in %p -pass file:<(sudo systemd-ask-password --no-tty)'"
PGDATAKEYWRAPCMD="bash -c 'openssl enc -e -aes-128-cbc -pbkdf2 -out %p -pass file:<(sudo systemd-ask-password --no-tty)'"
PGDATAKEYUNWRAPCMD="bash -c 'openssl enc -d -aes-128-cbc -pbkdf2 -in %p -pass file:<(sudo systemd-ask-password --no-tty)'"
```

You also need an entry like in `/etc/sudoers`:
Expand Down Expand Up @@ -141,8 +141,8 @@ vault secrets enable transit
# create a key (pick a name)
vault write -f transit/keys/pg-tde-master-1

PGDATAKEYWRAPCMD='base64 | vault write -field=ciphertext transit/encrypt/pg-tde-master-1 plaintext=- &gt; %p'
PGDATAKEYUNWRAPCMD='vault write -field=plaintext transit/decrypt/pg-tde-master-1 ciphertext=- &lt; %p | base64 -d'
PGDATAKEYWRAPCMD='base64 | vault write -field=ciphertext transit/encrypt/pg-tde-master-1 plaintext=- > %p'
PGDATAKEYUNWRAPCMD='vault write -field=plaintext transit/decrypt/pg-tde-master-1 ciphertext=- < %p | base64 -d'
```

## Key rotation
Expand Down

1 comment on commit 3636595

@github-actions
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.