pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedPasswords in clear text in server log
17+ messages / 7 participants
[nested] [flat]
* Passwords in clear text in server log
@ 2017-10-11 14:30 Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 17+ messages in thread
From: Don Seiler @ 2017-10-11 14:30 UTC (permalink / raw)
To: pgsql-admin
When I run a CREATE USER or ALTER USER statement and set a password for a
user, that statement gets printed to the server log, along with the
password, IN CLEAR TEXT. For example:
2017-10-11 09:20:40 CDT [19024]: [3-1]
db=postgres,user=postgres,app=psql,client=[local] LOG: statement: CREATE
USER foo PASSWORD 'bar';
2017-10-11 09:20:42 CDT [19024]: [4-1]
db=postgres,user=postgres,app=psql,client=[local] LOG: statement: ALTER
USER foo PASSWORD 'boo123';
These seems like a really bad security bug. Regardless of what other log
statement settings you may have, there should never be a reason to print a
password in plain text to the logs.
This was in Postgres 9.6.4.
Don.
--
Don Seiler
www.seiler.us
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
@ 2017-10-11 14:48 ` Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
0 siblings, 1 reply; 17+ messages in thread
From: Tom Lane @ 2017-10-11 14:48 UTC (permalink / raw)
To: Don Seiler <don@seiler.us>; +Cc: pgsql-admin
Don Seiler <don@seiler.us> writes:
> When I run a CREATE USER or ALTER USER statement and set a password for a
> user, that statement gets printed to the server log, along with the
> password, IN CLEAR TEXT.
This is why psql has provisions for encrypting a new password on the
client side --- see \password.
More generally, almost any SQL command might contain data that somebody
thinks is sensitive for some purpose or other. If you're going to log
commands, it behooves you to make sure the log is not widely readable.
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
@ 2017-10-11 15:22 ` Don Seiler <don@seiler.us>
2017-10-11 15:33 ` Re: Passwords in clear text in server log Scott Marlowe <scott.marlowe@gmail.com>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 2 replies; 17+ messages in thread
From: Don Seiler @ 2017-10-11 15:22 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin
On Wed, Oct 11, 2017 at 9:48 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Don Seiler <don@seiler.us> writes:
> > When I run a CREATE USER or ALTER USER statement and set a password for a
> > user, that statement gets printed to the server log, along with the
> > password, IN CLEAR TEXT.
>
> This is why psql has provisions for encrypting a new password on the
> client side --- see \password.
>
That's nice to have that option, but why even make it an option? If this
is a dead horse that was finished being beaten years ago, my apologies. I'm
curious what other non-psql clients do when allowing a user to change their
password, I've only ever tried it with psql on the local DB host.
More generally, almost any SQL command might contain data that somebody
> thinks is sensitive for some purpose or other. If you're going to log
> commands, it behooves you to make sure the log is not widely readable.
I strongly disagree. Sure, I might have HIPAA or financial data but we're
talking about database user security here. Why would we *ever* want that
logged to server logs? Regardless of if it was initially transmitted over
the wire in plain text or whatever else the client/user can control, there
should never be a reason to log that value in clear text (IMHO). It seems
like it would only ever be a liability. Log the CREATE/ALTER user command
(according to the log_statement value) but mask the password.
--
Don Seiler
www.seiler.us
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
@ 2017-10-11 15:33 ` Scott Marlowe <scott.marlowe@gmail.com>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:47 ` Re: Passwords in clear text in server log Stephen Frost <sfrost@snowman.net>
1 sibling, 2 replies; 17+ messages in thread
From: Scott Marlowe @ 2017-10-11 15:33 UTC (permalink / raw)
To: Don Seiler <don@seiler.us>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
On Wed, Oct 11, 2017 at 9:22 AM, Don Seiler <don@seiler.us> wrote:
> On Wed, Oct 11, 2017 at 9:48 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>>
>> Don Seiler <don@seiler.us> writes:
>> > When I run a CREATE USER or ALTER USER statement and set a password for
>> > a
>> > user, that statement gets printed to the server log, along with the
>> > password, IN CLEAR TEXT.
>>
>> This is why psql has provisions for encrypting a new password on the
>> client side --- see \password.
>
>
> That's nice to have that option, but why even make it an option? If this is
> a dead horse that was finished being beaten years ago, my apologies. I'm
> curious what other non-psql clients do when allowing a user to change their
> password, I've only ever tried it with psql on the local DB host.
>
>> More generally, almost any SQL command might contain data that somebody
>> thinks is sensitive for some purpose or other. If you're going to log
>> commands, it behooves you to make sure the log is not widely readable.
>
>
> I strongly disagree. Sure, I might have HIPAA or financial data but we're
> talking about database user security here. Why would we *ever* want that
> logged to server logs? Regardless of if it was initially transmitted over
> the wire in plain text or whatever else the client/user can control, there
> should never be a reason to log that value in clear text (IMHO). It seems
> like it would only ever be a liability. Log the CREATE/ALTER user command
> (according to the log_statement value) but mask the password.
FYI our standard hack here is to run
set log_statement='none';
alter user ...
I do agree it would be nice to have postgres stamp out the password
field with *** when logging though
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:33 ` Re: Passwords in clear text in server log Scott Marlowe <scott.marlowe@gmail.com>
@ 2017-10-11 15:37 ` Don Seiler <don@seiler.us>
1 sibling, 0 replies; 17+ messages in thread
From: Don Seiler @ 2017-10-11 15:37 UTC (permalink / raw)
To: Scott Marlowe <scott.marlowe@gmail.com>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
On Wed, Oct 11, 2017 at 10:33 AM, Scott Marlowe <scott.marlowe@gmail.com>
wrote:
> FYI our standard hack here is to run
>
> set log_statement='none';
> alter user ...
>
>
I've seen that suggested in some forums as well. Then you aren't logging
the fact that the password was changed at all. I think you'd still want to
know of the fact that it occurred, but my suggestion is that we shouldn't
be logging the value.
--
Don Seiler
www.seiler.us
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:33 ` Re: Passwords in clear text in server log Scott Marlowe <scott.marlowe@gmail.com>
@ 2017-10-11 15:47 ` Stephen Frost <sfrost@snowman.net>
1 sibling, 0 replies; 17+ messages in thread
From: Stephen Frost @ 2017-10-11 15:47 UTC (permalink / raw)
To: Scott Marlowe <scott.marlowe@gmail.com>; +Cc: Don Seiler <don@seiler.us>; Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
Scott, Don, all,
* Scott Marlowe (scott.marlowe@gmail.com) wrote:
> FYI our standard hack here is to run
>
> set log_statement='none';
> alter user ...
That's pretty terrible, frankly.
> I do agree it would be nice to have postgres stamp out the password
> field with *** when logging though
The right approach is to use SCRAM and the exported libpq functions for
generating a proper verifier that is then passed to ALTER USER, just
like \password does in psql.
Of course, SCRAM is only in v10. The old md5 method has other issues
beyond this. Better than all of the above is to use either Kerberos or
client-side certificates.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
@ 2017-10-11 15:37 ` Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
1 sibling, 1 reply; 17+ messages in thread
From: Tom Lane @ 2017-10-11 15:37 UTC (permalink / raw)
To: Don Seiler <don@seiler.us>; +Cc: pgsql-admin
Don Seiler <don@seiler.us> writes:
> On Wed, Oct 11, 2017 at 9:48 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> This is why psql has provisions for encrypting a new password on the
>> client side --- see \password.
> That's nice to have that option, but why even make it an option? If this
> is a dead horse that was finished being beaten years ago, my apologies.
Yes, people have complained about this before, but they're asking for
an impossibility, which is for necessarily-pretty-dumb logging code
to decide which parts of SQL commands somebody might think are sensitive.
I don't intend to spend much time arguing about this, because you can find
previous discussions in the PG archives if you're so inclined. But I do
remember one simple counterexample: if you fat-finger the command syntax,
say
ALTER YSER joe PASSWORD 'notsosecret'
would you still expect the logging code to figure out that it should
suppress the password?
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
@ 2017-10-11 16:11 ` Don Seiler <don@seiler.us>
2017-10-11 16:19 ` Re: Passwords in clear text in server log Stephen Frost <sfrost@snowman.net>
2017-10-11 19:43 ` Re: Passwords in clear text in server log Alvaro Herrera <alvherre@alvh.no-ip.org>
0 siblings, 2 replies; 17+ messages in thread
From: Don Seiler @ 2017-10-11 16:11 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin
On Wed, Oct 11, 2017 at 10:37 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> I don't intend to spend much time arguing about this, because you can find
> previous discussions in the PG archives if you're so inclined. But I do
> remember one simple counterexample: if you fat-finger the command syntax,
> say
>
> ALTER YSER joe PASSWORD 'notsosecret'
>
> would you still expect the logging code to figure out that it should
> suppress the password?
>
This is actually more or less what happened when I noticed it this morning.
I happened to be tailing the server log when a user fat-fingered the
command twice and I realized I was looking at his password as typed. I see
the challenge you're presenting, but that doesn't make it acceptable to me
(but obviously still not easy to fix). Yes, I now know to use \password now
when I reset user passwords in psql, but I'll have see how these other
developer tools are doing it. This user was using IntelliJ but I'm assuming
the ALTER command was just typed into the SQL editor since it had to be
corrected twice.
If you're going to log statements that fail to parse, then yes it will make
it harder to close these loopholes. That's also new to me, coming from a
different RDBMS world. It logs neither bad (failed to parse) SQL nor user
passwords. Of course they also charge you tens of thousands of dollars per
core for partitioning, so it isn't all beer and skittles.
Long-term I'm hoping to get our PG databases talking to our LDAP, there's a
few internal issues and priorities that have that on the back burner for
now.
Thanks,
Don.
--
Don Seiler
www.seiler.us
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
@ 2017-10-11 16:19 ` Stephen Frost <sfrost@snowman.net>
2017-10-11 16:25 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
1 sibling, 1 reply; 17+ messages in thread
From: Stephen Frost @ 2017-10-11 16:19 UTC (permalink / raw)
To: Don Seiler <don@seiler.us>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
Don,
* Don Seiler (don@seiler.us) wrote:
> Long-term I'm hoping to get our PG databases talking to our LDAP, there's a
> few internal issues and priorities that have that on the back burner for
> now.
As I understand it, you're in an Active Directory environment, where
what you really want to be using for authentication is Kerberos / GSSAPI,
not LDAP. With LDAP, the password is still sent to the PG server in
cleartext during the authentication and that's entirely unnecessary in
an Active Directory environment where you have a Kerberos realm already
in place.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 16:19 ` Re: Passwords in clear text in server log Stephen Frost <sfrost@snowman.net>
@ 2017-10-11 16:25 ` Don Seiler <don@seiler.us>
0 siblings, 0 replies; 17+ messages in thread
From: Don Seiler @ 2017-10-11 16:25 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
On Wed, Oct 11, 2017 at 11:19 AM, Stephen Frost <sfrost@snowman.net> wrote:
> As I understand it, you're in an Active Directory environment, where
> what you really want to be using for authentication is Kerberos / GSSAPI,
> not LDAP. With LDAP, the password is still sent to the PG server in
> cleartext during the authentication and that's entirely unnecessary in
> an Active Directory environment where you have a Kerberos realm already
> in place.
Yes thanks for this info. I'll read up on Kerberos auth and change my
long-term plan on that accordingly.
Thanks,
Don.
--
Don Seiler
www.seiler.us
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
@ 2017-10-11 19:43 ` Alvaro Herrera <alvherre@alvh.no-ip.org>
2017-10-11 19:46 ` Re: Passwords in clear text in server log Ervin Weber <webervin@gmail.com>
1 sibling, 1 reply; 17+ messages in thread
From: Alvaro Herrera @ 2017-10-11 19:43 UTC (permalink / raw)
To: Don Seiler <don@seiler.us>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
Don Seiler wrote:
> If you're going to log statements that fail to parse, then yes it will make
> it harder to close these loopholes. That's also new to me, coming from a
> different RDBMS world. It logs neither bad (failed to parse) SQL nor user
> passwords.
Actually, I do wonder why we log statements that fail to parse. Surely
the client ought to know that it failed, but what is the value of
additionally storing the query in the server log?
--
Álvaro Herrera https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 19:43 ` Re: Passwords in clear text in server log Alvaro Herrera <alvherre@alvh.no-ip.org>
@ 2017-10-11 19:46 ` Ervin Weber <webervin@gmail.com>
2017-10-11 20:01 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 17+ messages in thread
From: Ervin Weber @ 2017-10-11 19:46 UTC (permalink / raw)
To: Alvaro Herrera <alvherre@alvh.no-ip.org>; +Cc: Don Seiler <don@seiler.us>; Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
Alvaro Herrera wrote:
> Actually, I do wonder why we log statements that fail to parse. Surely
> the client ought to know that it failed, but what is the value of
> additionally storing the query in the server log?
>
To debug clients who claim it is working on their end, but data does not change.
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 19:43 ` Re: Passwords in clear text in server log Alvaro Herrera <alvherre@alvh.no-ip.org>
2017-10-11 19:46 ` Re: Passwords in clear text in server log Ervin Weber <webervin@gmail.com>
@ 2017-10-11 20:01 ` Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 20:09 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 20:17 ` Re: Passwords in clear text in server log Williams, Alex <awilliams@teamdrg.com>
0 siblings, 2 replies; 17+ messages in thread
From: Tom Lane @ 2017-10-11 20:01 UTC (permalink / raw)
To: Ervin Weber <webervin@gmail.com>; +Cc: Alvaro Herrera <alvherre@alvh.no-ip.org>; Don Seiler <don@seiler.us>; pgsql-admin
Ervin Weber <webervin@gmail.com> writes:
> Alvaro Herrera wrote:
>> Actually, I do wonder why we log statements that fail to parse. Surely
>> the client ought to know that it failed, but what is the value of
>> additionally storing the query in the server log?
> To debug clients who claim it is working on their end, but data does not change.
We have heard many times from people who don't have enough insight, or
enough debug support client-side, to know exactly what queries their
apps are issuing. Disabling query logging would be a horrible setback
for debuggability of such apps. How many times have you said "consult
the postmaster log to find out what's going on"?
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 19:43 ` Re: Passwords in clear text in server log Alvaro Herrera <alvherre@alvh.no-ip.org>
2017-10-11 19:46 ` Re: Passwords in clear text in server log Ervin Weber <webervin@gmail.com>
2017-10-11 20:01 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
@ 2017-10-11 20:09 ` Don Seiler <don@seiler.us>
2017-10-11 20:28 ` Re: Passwords in clear text in server log Stephen Frost <sfrost@snowman.net>
1 sibling, 1 reply; 17+ messages in thread
From: Don Seiler @ 2017-10-11 20:09 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Ervin Weber <webervin@gmail.com>; Alvaro Herrera <alvherre@alvh.no-ip.org>; pgsql-admin
On Wed, Oct 11, 2017 at 3:01 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> We have heard many times from people who don't have enough insight, or
> enough debug support client-side, to know exactly what queries their
> apps are issuing. Disabling query logging would be a horrible setback
> for debuggability of such apps. How many times have you said "consult
> the postmaster log to find out what's going on"?
>
Not logging statements that fail to parse isn't the same as disabling query
logging. If a statement fails to parse it can't really be considered a
query in my opinion. When it fails to parse it *should* send a
loud-and-clear error to whatever client-side application sent it. Granted a
lazy developer could code their app to swallow all errors, but then I'd say
they deserve the headache.
--
Don Seiler
www.seiler.us
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 19:43 ` Re: Passwords in clear text in server log Alvaro Herrera <alvherre@alvh.no-ip.org>
2017-10-11 19:46 ` Re: Passwords in clear text in server log Ervin Weber <webervin@gmail.com>
2017-10-11 20:01 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 20:09 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
@ 2017-10-11 20:28 ` Stephen Frost <sfrost@snowman.net>
0 siblings, 0 replies; 17+ messages in thread
From: Stephen Frost @ 2017-10-11 20:28 UTC (permalink / raw)
To: Don Seiler <don@seiler.us>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; Ervin Weber <webervin@gmail.com>; Alvaro Herrera <alvherre@alvh.no-ip.org>; pgsql-admin
Don,
* Don Seiler (don@seiler.us) wrote:
> On Wed, Oct 11, 2017 at 3:01 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> > We have heard many times from people who don't have enough insight, or
> > enough debug support client-side, to know exactly what queries their
> > apps are issuing. Disabling query logging would be a horrible setback
> > for debuggability of such apps. How many times have you said "consult
> > the postmaster log to find out what's going on"?
>
> Not logging statements that fail to parse isn't the same as disabling query
> logging. If a statement fails to parse it can't really be considered a
> query in my opinion. When it fails to parse it *should* send a
> loud-and-clear error to whatever client-side application sent it. Granted a
> lazy developer could code their app to swallow all errors, but then I'd say
> they deserve the headache.
While I enjoy the general sentiment, it's really just overly constrained
when it comes to the development environments out there today. Quite
often, developers aren't actually hand-crafting SQL queries but instead
letting some framework or what-have-you generate them and the error
being thrown on a parse failure could be difficult to distinguish from a
server closed connection or similar failure at the higher levels. Yes,
ideally, that would still end up getting into a log file somewhere, but
now you're talking about the app-side log files which are often spread
across hundreds of app servers, or, at best, collected into some massive
logging system that it isn't easy to look through.
All that said, I'd be open to allowing users to decide if they wish to
log parse errors or not and perhaps we can put some caveats around that
to let people know how logging of parse errors could end up putting
things into the logs that they may not wish were there. Further, we
could then consider doing something more interesting when it comes to
logging of ALTER ROLE statements when passwords are included, perhaps,
since the above considered switch would eliminate the concern about
syntax errors.
I'm not sure how ugly that would end up getting though, so no promises.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 19:43 ` Re: Passwords in clear text in server log Alvaro Herrera <alvherre@alvh.no-ip.org>
2017-10-11 19:46 ` Re: Passwords in clear text in server log Ervin Weber <webervin@gmail.com>
2017-10-11 20:01 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
@ 2017-10-11 20:17 ` Williams, Alex <awilliams@teamdrg.com>
2017-10-12 17:46 ` Re: Passwords in clear text in server log Williams, Alex <awilliams@teamdrg.com>
1 sibling, 1 reply; 17+ messages in thread
From: Williams, Alex @ 2017-10-11 20:17 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; Ervin Weber <webervin@gmail.com>; +Cc: Alvaro Herrera <alvherre@alvh.no-ip.org>; Don Seiler <don@seiler.us>; pgsql-admin
"We have heard many times from people who don't have enough insight, or
enough debug support client-side, to know exactly what queries their
apps are issuing. Disabling query logging would be a horrible setback
for debuggability of such apps. How many times have you said "consult
the postmaster log to find out what's going on"?"
I completely agree. There are many cases, not just edge cases, where this has been vital to isolate and resolve issues.
________________________________
From: pgsql-admin-owner@postgresql.org <pgsql-admin-owner@postgresql.org> on behalf of Tom Lane <tgl@sss.pgh.pa.us>
Sent: Wednesday, October 11, 2017 4:01:10 PM
To: Ervin Weber
Cc: Alvaro Herrera; Don Seiler; pgsql-admin
Subject: Re: [ADMIN] Passwords in clear text in server log
Ervin Weber <webervin@gmail.com> writes:
> Alvaro Herrera wrote:
>> Actually, I do wonder why we log statements that fail to parse. Surely
>> the client ought to know that it failed, but what is the value of
>> additionally storing the query in the server log?
> To debug clients who claim it is working on their end, but data does not change.
We have heard many times from people who don't have enough insight, or
enough debug support client-side, to know exactly what queries their
apps are issuing. Disabling query logging would be a horrible setback
for debuggability of such apps. How many times have you said "consult
the postmaster log to find out what's going on"?
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 17+ messages in thread
* Re: Passwords in clear text in server log
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 15:37 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Re: Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 19:43 ` Re: Passwords in clear text in server log Alvaro Herrera <alvherre@alvh.no-ip.org>
2017-10-11 19:46 ` Re: Passwords in clear text in server log Ervin Weber <webervin@gmail.com>
2017-10-11 20:01 ` Re: Passwords in clear text in server log Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 20:17 ` Re: Passwords in clear text in server log Williams, Alex <awilliams@teamdrg.com>
@ 2017-10-12 17:46 ` Williams, Alex <awilliams@teamdrg.com>
0 siblings, 0 replies; 17+ messages in thread
From: Williams, Alex @ 2017-10-12 17:46 UTC (permalink / raw)
To: pgsql-admin
Hello,
Why was my message flagged via fraud detection? What do I need to do to prevent that so I can reply?
We have several email aliases at my work location: awilliams@teamdrg.com , awilliams@dresources.com<mailto:awilliams@dresources.com> and awilliams@dresourcesgroup.com<mailto:awilliams@dresourcesgroup.com> - I believe my outlook client was reconfigured recently to use @teamdrg.com, but I have posted here before, but I think that was using @dresources.com
Thanks,
Alex
From: pgsql-admin-owner@postgresql.org [mailto:pgsql-admin-owner@postgresql.org] On Behalf Of Williams, Alex
Sent: Wednesday, October 11, 2017 4:18 PM
To: Tom Lane <tgl@sss.pgh.pa.us>; Ervin Weber <webervin@gmail.com>
Cc: Alvaro Herrera <alvherre@alvh.no-ip.org>; Don Seiler <don@seiler.us>; pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: [ADMIN] Passwords in clear text in server log
This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing<http://aka.ms/LearnAboutSpoofing;
Feedback<http://aka.ms/SafetyTipsFeedback;
"We have heard many times from people who don't have enough insight, or
enough debug support client-side, to know exactly what queries their
apps are issuing. Disabling query logging would be a horrible setback
for debuggability of such apps. How many times have you said "consult
the postmaster log to find out what's going on"?"
I completely agree. There are many cases, not just edge cases, where this has been vital to isolate and resolve issues.
________________________________
From: pgsql-admin-owner@postgresql.org<mailto:pgsql-admin-owner@postgresql.org> <pgsql-admin-owner@postgresql.org<mailto:pgsql-admin-owner@postgresql.org>> on behalf of Tom Lane <tgl@sss.pgh.pa.us<mailto:tgl@sss.pgh.pa.us>>
Sent: Wednesday, October 11, 2017 4:01:10 PM
To: Ervin Weber
Cc: Alvaro Herrera; Don Seiler; pgsql-admin
Subject: Re: [ADMIN] Passwords in clear text in server log
Ervin Weber <webervin@gmail.com<mailto:webervin@gmail.com>> writes:
> Alvaro Herrera wrote:
>> Actually, I do wonder why we log statements that fail to parse. Surely
>> the client ought to know that it failed, but what is the value of
>> additionally storing the query in the server log?
> To debug clients who claim it is working on their end, but data does not change.
We have heard many times from people who don't have enough insight, or
enough debug support client-side, to know exactly what queries their
apps are issuing. Disabling query logging would be a horrible setback
for debuggability of such apps. How many times have you said "consult
the postmaster log to find out what's going on"?
regards, tom lane
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org<mailto:pgsql-admin@postgresql.org>)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
^ permalink raw reply [nested|flat] 17+ messages in thread
end of thread, other threads:[~2017-10-12 17:46 UTC | newest]
Thread overview: 17+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2017-10-11 14:30 Passwords in clear text in server log Don Seiler <don@seiler.us>
2017-10-11 14:48 ` Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 15:22 ` Don Seiler <don@seiler.us>
2017-10-11 15:33 ` Scott Marlowe <scott.marlowe@gmail.com>
2017-10-11 15:37 ` Don Seiler <don@seiler.us>
2017-10-11 15:47 ` Stephen Frost <sfrost@snowman.net>
2017-10-11 15:37 ` Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 16:11 ` Don Seiler <don@seiler.us>
2017-10-11 16:19 ` Stephen Frost <sfrost@snowman.net>
2017-10-11 16:25 ` Don Seiler <don@seiler.us>
2017-10-11 19:43 ` Alvaro Herrera <alvherre@alvh.no-ip.org>
2017-10-11 19:46 ` Ervin Weber <webervin@gmail.com>
2017-10-11 20:01 ` Tom Lane <tgl@sss.pgh.pa.us>
2017-10-11 20:09 ` Don Seiler <don@seiler.us>
2017-10-11 20:28 ` Stephen Frost <sfrost@snowman.net>
2017-10-11 20:17 ` Williams, Alex <awilliams@teamdrg.com>
2017-10-12 17:46 ` Williams, Alex <awilliams@teamdrg.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox