Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e2JEf-00036S-Gs for pgsql-admin@arkaria.postgresql.org; Wed, 11 Oct 2017 15:47:53 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1e2JEe-0006fd-SB for pgsql-admin@arkaria.postgresql.org; Wed, 11 Oct 2017 15:47:52 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1e2JEe-0006fI-C0 for pgsql-admin@postgresql.org; Wed, 11 Oct 2017 15:47:52 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by magus.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e2JEb-0001C7-S1 for pgsql-admin@postgresql.org; Wed, 11 Oct 2017 15:47:51 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 168695F795; Wed, 11 Oct 2017 11:47:49 -0400 (EDT) Date: Wed, 11 Oct 2017 11:47:49 -0400 From: Stephen Frost To: Scott Marlowe Cc: Don Seiler , Tom Lane , pgsql-admin Subject: Re: Passwords in clear text in server log Message-ID: <20171011154748.GM4628@tamriel.snowman.net> References: <9072.1507733313@sss.pgh.pa.us> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="WqyEbc136sAmtdRM" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org --WqyEbc136sAmtdRM Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Scott, Don, all, * Scott Marlowe (scott.marlowe@gmail.com) wrote: > FYI our standard hack here is to run >=20 > set log_statement=3D'none'; > alter user ... That's pretty terrible, frankly. > I do agree it would be nice to have postgres stamp out the password > field with *** when logging though The right approach is to use SCRAM and the exported libpq functions for generating a proper verifier that is then passed to ALTER USER, just like \password does in psql. Of course, SCRAM is only in v10. The old md5 method has other issues beyond this. Better than all of the above is to use either Kerberos or client-side certificates. Thanks! Stephen --WqyEbc136sAmtdRM Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJZ3j0kAAoJEO1sijiDR2RVMZIQALDCEW/5ZYn4BNJpxZVjcxh+ u9oAj5ieSH6fmjOZJHnulhPdHIIOtvqcZL+p1q7NQXHJsOafAzJCQhP6wmF6KBEq LI5Y/JGC16+c5OS66xLgh0pnn6ulPijnEtjsysn0cTT73kkeIDNyIEM/7+p7vjFR 8G6qjdsYmyTsRC1b8iGC/7Fl785QyNOKJz7AJ71JOV/4yqREtHu+gGxvbX5Oc3Tj iyMiwQEhp7aNizP4YYTnAw4YYRfv1ALU3TcLawK/e2vcm+Y3KDByJZY295RLvyjm tZRQZxRWR/B4YZGVyeIBNAt2RA04TT1ZlMqPAXS3FlnGTrfTCFfuEeNH5iw7/DtF RZb48MPzxr77A+qHmxqoY5TeWu3QtmJHK8w4KZDQ+wOk75oLrOIzUunVEM8Ysr0v CTXVEBybVAJn3ynT6lTo74twX3qSo91QW1kzg7NdtPDvamxIxK46qxw2zDfBGpd0 Wy6R1yiLDFR6C/TXGInavPK3uaiZGyB+FjTnihk19V/xbqppWkZ1M5FQBxJqQmHP XJR7769JHSBY3fqvW2vxArmadYh9ElsRj0+VTl8PBepxEZk5DFf12IYiP+qZ73wn ErILPi8gmlzNwF4W9iDGE5IDrmFiB5Hi/eYpxKV6thGuD/NXSlC3dreDAYM54vTF fqA59xqS8YZNfHXd0toe =hcma -----END PGP SIGNATURE----- --WqyEbc136sAmtdRM--