To: Scott Marlowe <scott.marlowe@gmail.com>
cc: Keith Pinnix <kpinnix@yahoo.com>, pgsql-admin@postgresql.org
Subject: Re: postgresql 8.3 logging user passwords in clear text 
In-reply-to: <AANLkTin+RnK=K0tONO0M+q9xtfqgLdEx-1TwvELO7VwX@mail.gmail.com> 
References: <624891.14568.qm@web36907.mail.mud.yahoo.com>
	<AANLkTikTa-_86i9umBEY5yFCnT5emr=n4mJhNG1knvzx@mail.gmail.com>
	<521611.74185.qm@web36904.mail.mud.yahoo.com>
	<AANLkTin+RnK=K0tONO0M+q9xtfqgLdEx-1TwvELO7VwX@mail.gmail.com>
Comments: In-reply-to Scott Marlowe <scott.marlowe@gmail.com>
	message dated "Tue, 24 Aug 2010 13:01:51 -0600"
Date: Tue, 24 Aug 2010 15:40:35 -0400
Message-ID: <3753.1282678835@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>

Scott Marlowe <scott.marlowe@gmail.com> writes:
> On Tue, Aug 24, 2010 at 12:20 PM, Keith Pinnix <kpinnix@yahoo.com> wrote:
>> The entries are from dblimk something like below:
>>  SELECT * FROM dblink('dbname=XXXXXX  host=XXXXXX port=XXX  user=XXXXX
>> password=XXXXXXX ',

> You could set up those machines to connect via trust.  But yeah,
> dblink otherwise has passwords in the connect string.

Actually, the general opinion on this is that the postmaster log files
have to be protected because they might contain sensitive data;
*especially* so if you're enabling log_statements, but even without
that.  dblink passwords are just one small manifestation of the general
problem.  As an example, you might be inserting customers' credit card
numbers or some such into your tables.  Even if the log_statement
mechanism understood that it should hide passwords, it's hardly likely
to know that specific bits of ordinary data have security implications.

IOW: you're trying to fix this in the wrong place.  Secure your
logfiles, don't imagine that you can prevent there being any sensitive
info in them.

			regards, tom lane