From kpinnix@yahoo.com Mon Aug  23 23:48:02 2010
Received: from maia.hub.org (maia-2.hub.org [200.46.204.251])
	by mail.postgresql.org (Postfix) with ESMTP id D032D632843
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Mon, 23 Aug 2010 20:48:02 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.251]) (amavisd-maia,
	port 10024) with ESMTP id 08708-02 for
	<pgsql-admin-postgresql.org@mail.postgresql.org>;
	Mon, 23 Aug 2010 23:47:54 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from web36907.mail.mud.yahoo.com (web36907.mail.mud.yahoo.com
	[209.191.85.75])
	by mail.postgresql.org (Postfix) with SMTP id 95BDE632694
	for <pgsql-admin@postgresql.org>; Mon, 23 Aug 2010 20:47:55 -0300 (ADT)
Received: (qmail 17903 invoked by uid 60001); 23 Aug 2010 23:47:53 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024;
	t=1282607273; bh=wGF5mxH9Lvmwv6n5IHv5qnzEJ+3eA58/+LMmOvoCuMI=;
	h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
	b=274Or0VTglfjyi/iJBP8VXxBLGpMVXAI9P+IMGh1wO9ZlDimbgg+vDqd2/3MLW2bqHwGcY+RGUtcz1OrhXP4JDG2XttNBlCj5Fi3IUGyuon9sahR8qAS+I7YWYILsVtLOK6Ww5Weop4vJhM3fvViyi9YvtivZLruOPhwqxQhA1o=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com;
	h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
	b=seGBsVqJX7qaLAgt7vw+akCAesn9vAC+hlWxqe6ArvHhXTNb5qAKiyvLUIKj2Tmgr9RiTU70uQLgwpviGh3crjCS/N+R4kxPbhZzMhIHYzqryuoWiQH10Eqh9RcnbhQRGh8An6zIMua/8VfuKVbh0lHKXe+UeqingzTghuxc6XA=;
Message-ID: <624891.14568.qm@web36907.mail.mud.yahoo.com>
X-YMail-OSG: 6Cr1XPkVM1nPB4cG9LwB7Z7vw6bnM.2BLdtayVRfIwje8La
	R8jQwZR8wSgks2AoFRNWIsZfpei08SJL0yN9XBSLcfmedw77gkrYmkOq4Z6a
	AH7DqIXPOz_xZVF4DMpjqjYd14j7rOcrXrkSSAlzTQe4p16dx2OGlMB_FV4B
	zj5u_IM0wQWeKC6p.gB8qdPcySd3HHgRNjW9z04_Pfu_HroG8j_8Kg9hgsGN
	J8g.U8IA6ThhnnbW1fAfwYnWnMJ.GneK4ZbDcVk_zqjVDqAWRhHqV3Q4wyRW
	sX14HcEY4dvkqRKIpGpN_w9o2n.T5cv3vbh7.iTzgr96z15ydJZbP
Received: from [71.6.82.226] by web36907.mail.mud.yahoo.com via HTTP;
	Mon, 23 Aug 2010 16:47:53 PDT
X-Mailer: YahooMailRC/470 YahooMailWebService/0.8.105.279950
Date: Mon, 23 Aug 2010 16:47:53 -0700 (PDT)
From: Keith Pinnix <kpinnix@yahoo.com>
Subject: postgresql 8.3  logging user passwords in clear text
To: pgsql-admin@postgresql.org
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-888677344-1282607273=:14568"
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-0.509 tagged_above=-10 required=5
	tests=BAYES_05=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001,
	T_RP_MATCHES_RCVD=-0.01
X-Spam-Level: 
X-Archive-Number: 201008/164
X-Sequence-Number: 35413

--0-888677344-1282607273=:14568
Content-Type: text/plain; charset=us-ascii

All:

I have a postgresql instance and I have noticed that it is logging the user 
passwords in clear text in the postgresql.log.   Is this configurable so that it 
retains the user info and commands but does not log the password?

Keith
--0-888677344-1282607273=:14568
Content-Type: text/html; charset=us-ascii

<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman,new york,times,serif;font-size:10pt"><div>All:<br><br>I have a postgresql instance and I have noticed that it is logging the user passwords in clear text in the postgresql.log.&nbsp;&nbsp; Is this configurable so that it retains the user info and commands but does not log the password?<br><br>Keith<br><br></div>
</div></body></html>
--0-888677344-1282607273=:14568--



From scott.marlowe@gmail.com Tue Aug  24 06:36:30 2010
Received: from maia.hub.org (maia-5.hub.org [200.46.204.29])
	by mail.postgresql.org (Postfix) with ESMTP id CE13263251D
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 24 Aug 2010 03:36:30 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024)
	with ESMTP id 17192-02 for
	<pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 24 Aug 2010 06:36:23 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from mail-wy0-f174.google.com (mail-wy0-f174.google.com
	[74.125.82.174])
	by mail.postgresql.org (Postfix) with ESMTP id 12174632456
	for <pgsql-admin@postgresql.org>; Tue, 24 Aug 2010 03:36:22 -0300 (ADT)
Received: by wyb35 with SMTP id 35so68889wyb.19
	for <pgsql-admin@postgresql.org>; Mon, 23 Aug 2010 23:36:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:received:received:in-reply-to
	:references:date:message-id:subject:from:to:cc:content-type
	:content-transfer-encoding;
	bh=ByfgAK4GhRxCtybRwrLf5jS2bCv7gdDSHKWMc1KcIfQ=;
	b=vnCn4Oa2X5yrd4MQFG8gIN0Z4Cn+A6RGvbgsjhRhzA4Sx0fkuuaFZQqCNZ63y6/dkE
	rztiZvy32I9SDTE0LMwv02Mpkxm+hXQh2oKWdl73VbOM0a9fsCA9UPQRZYPpXqopNW30
	VZbKedYVZB30nL2PZD1WzmqDJScJAmoaLmCdo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type:content-transfer-encoding;
	b=SrVsTyR/OVqiYzHp22vf4PHPj7+GGddkI3/rv7ciuT/u+E1/lx6ysPFPLAZvOiS/Fu
	cSpjRFLu3D2yyJBtKJg8utU6uT5ODrLMjrCKrEpeE2R0VWA0+t4XReUg5+dtgSP2MZZi
	4UYp7jm/3kAOHX80Bk5cNn58E8Z6FZVkCg6lM=
MIME-Version: 1.0
Received: by 10.227.42.4 with SMTP id q4mr5517957wbe.156.1282631781826; Mon,
	23 Aug 2010 23:36:21 -0700 (PDT)
Received: by 10.227.148.75 with HTTP; Mon, 23 Aug 2010 23:36:21 -0700 (PDT)
In-Reply-To: <624891.14568.qm@web36907.mail.mud.yahoo.com>
References: <624891.14568.qm@web36907.mail.mud.yahoo.com>
Date: Tue, 24 Aug 2010 00:36:21 -0600
Message-ID: <AANLkTikTa-_86i9umBEY5yFCnT5emr=n4mJhNG1knvzx@mail.gmail.com>
Subject: Re: postgresql 8.3 logging user passwords in clear text
From: Scott Marlowe <scott.marlowe@gmail.com>
To: Keith Pinnix <kpinnix@yahoo.com>
Cc: pgsql-admin@postgresql.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-1.9 tagged_above=-10 required=5 tests=BAYES_00=-1.9,
	RCVD_IN_DNSWL_NONE=-0.0001
X-Spam-Level: 
X-Archive-Number: 201008/165
X-Sequence-Number: 35414

On Mon, Aug 23, 2010 at 5:47 PM, Keith Pinnix <kpinnix@yahoo.com> wrote:
> All:
>
> I have a postgresql instance and I have noticed that it is logging the us=
er
> passwords in clear text in the postgresql.log.=A0=A0 Is this configurable=
 so
> that it retains the user info and commands but does not log the password?

Got some redacted log examples?



From alvherre@commandprompt.com Tue Aug  24 17:04:27 2010
Received: from maia.hub.org (maia-2.hub.org [200.46.204.251])
	by mail.postgresql.org (Postfix) with ESMTP id E2310632329
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 24 Aug 2010 14:04:27 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.251]) (amavisd-maia,
	port 10024) with ESMTP id 19402-04-5
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 24 Aug 2010 17:04:20 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from spinlock.commandprompt.com (host-215.commandprompt.net
	[207.173.203.215])
	by mail.postgresql.org (Postfix) with ESMTP id CD93A6342CB
	for <pgsql-admin@postgresql.org>; Tue, 24 Aug 2010 14:04:20 -0300 (ADT)
Received: from localhost (localhost [127.0.0.1])
	by spinlock.commandprompt.com (Postfix) with ESMTP id 3E276348002;
	Tue, 24 Aug 2010 10:04:17 -0700 (PDT)
X-Virus-Scanned: Debian amavisd-new at commandprompt.com
Received: from spinlock.commandprompt.com ([127.0.0.1])
	by localhost (spinlock.commandprompt.com.commandprompt.com [127.0.0.1])
	(amavisd-new, port 10024)
	with ESMTP id 9ZSvBjSMbHHv; Tue, 24 Aug 2010 10:04:11 -0700 (PDT)
Received: from perhan.alvh.no-ip.org (200-85-200-241.bk3-dsl.surnet.cl
	[200.85.200.241])
	by spinlock.commandprompt.com (Postfix) with ESMTPSA id 15AA8348034;
	Tue, 24 Aug 2010 10:04:11 -0700 (PDT)
Received: by perhan.alvh.no-ip.org (Postfix, from userid 1000)
	id 1F1566E3F7; Tue, 24 Aug 2010 13:04:07 -0400 (CLT)
Content-Type: text/plain; charset=UTF-8
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: postgresql 8.3 logging user passwords in clear text
From: Alvaro Herrera <alvherre@commandprompt.com>
To: Keith Pinnix <kpinnix@yahoo.com>
In-reply-to: <624891.14568.qm@web36907.mail.mud.yahoo.com>
References: <624891.14568.qm@web36907.mail.mud.yahoo.com>
Date: Tue, 24 Aug 2010 13:04:07 -0400
Message-Id: <1282669372-sup-226@alvh.no-ip.org>
User-Agent: Sup/git
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-1.9 tagged_above=-10 required=5 tests=BAYES_00=-1.9
X-Spam-Level: 
X-Archive-Number: 201008/182
X-Sequence-Number: 35431

Excerpts from Keith Pinnix's message of lun ago 23 19:47:53 -0400 2010:
> All:
> 
> I have a postgresql instance and I have noticed that it is logging the user 
> passwords in clear text in the postgresql.log.   Is this configurable so that it 
> retains the user info and commands but does not log the password?

In what context?  If you're doing ALTER ROLE / PASSWORD with the
password in clear text, then that's obviously going to show up in the
log.  The solution is to encrypt them client-side; for example use
\password in psql to change passwords, which does that automatically.

-- 
�lvaro Herrera <alvherre@commandprompt.com>
The PostgreSQL Company - Command Prompt, Inc.
PostgreSQL Replication, Consulting, Custom Development, 24x7 support



From scott.marlowe@gmail.com Tue Aug  24 19:02:00 2010
Received: from maia.hub.org (maia-5.hub.org [200.46.204.29])
	by mail.postgresql.org (Postfix) with ESMTP id 540C2632ABC
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 24 Aug 2010 16:02:00 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.29]) (amavisd-maia, port 10024)
	with ESMTP id 44940-03 for
	<pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 24 Aug 2010 19:01:53 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from mail-wy0-f174.google.com (mail-wy0-f174.google.com
	[74.125.82.174])
	by mail.postgresql.org (Postfix) with ESMTP id BA7B56329F3
	for <pgsql-admin@postgresql.org>; Tue, 24 Aug 2010 16:01:52 -0300 (ADT)
Received: by wyb35 with SMTP id 35so802198wyb.19
	for <pgsql-admin@postgresql.org>; Tue, 24 Aug 2010 12:01:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:mime-version:received:received:in-reply-to
	:references:date:message-id:subject:from:to:content-type
	:content-transfer-encoding;
	bh=QNZamMlWvGOzLgVUmsyo/Q2vvpd08PTJ+JgHZrW10VQ=;
	b=GQrix35YKMRBCS/xcpYw+pozLSELETeUxFTfWjhytE5yDepYkwrXOMRj8ZazcMX2jd
	kwMo4c0L1TFCIQjxbNr86chn5lB1gJ+a0/rK//L4ZW1Z9TwfhAgFjHlBPN35HMpAcB6X
	1AV/4vRejY4JpgZaL8T7KF5NaNKKjEy0lR9jE=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:content-type:content-transfer-encoding;
	b=kbOCKuj4s6q+Me1YF4zbKu5S20jQbnDq6fxNfdnr3X6wOPf9SpS/RgJMNVsF5VyCky
	8Ka96ZpkIcMABHHh4FF8baandYM8qjsjLRv8HOPOHAwm5qtDmFkmCd6RS7uOMNqOWHvl
	PREqz+XFlUnE7pXzQO/diAAO5AHfA1RUGDw3k=
MIME-Version: 1.0
Received: by 10.227.151.148 with SMTP id c20mr6397213wbw.15.1282676511118;
	Tue, 24 Aug 2010 12:01:51 -0700 (PDT)
Received: by 10.227.148.75 with HTTP; Tue, 24 Aug 2010 12:01:51 -0700 (PDT)
In-Reply-To: <521611.74185.qm@web36904.mail.mud.yahoo.com>
References: <624891.14568.qm@web36907.mail.mud.yahoo.com>
	<AANLkTikTa-_86i9umBEY5yFCnT5emr=n4mJhNG1knvzx@mail.gmail.com>
	<521611.74185.qm@web36904.mail.mud.yahoo.com>
Date: Tue, 24 Aug 2010 13:01:51 -0600
Message-ID: <AANLkTin+RnK=K0tONO0M+q9xtfqgLdEx-1TwvELO7VwX@mail.gmail.com>
Subject: Re: postgresql 8.3 logging user passwords in clear text
From: Scott Marlowe <scott.marlowe@gmail.com>
To: Keith Pinnix <kpinnix@yahoo.com>, pgsql-admin@postgresql.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-1.9 tagged_above=-10 required=5 tests=BAYES_00=-1.9,
	RCVD_IN_DNSWL_NONE=-0.0001
X-Spam-Level: 
X-Archive-Number: 201008/187
X-Sequence-Number: 35436

On Tue, Aug 24, 2010 at 12:20 PM, Keith Pinnix <kpinnix@yahoo.com> wrote:
> Scott:
>
> The entries are from dblimk something like below:
>
> =A0SELECT * FROM dblink('dbname=3DXXXXXX=A0 host=3DXXXXXX port=3DXXX=A0 u=
ser=3DXXXXX
> password=3DXXXXXXX ',
>
> We use this feature quite a bit and this presents quite a security issue.
> We are currently using=A0 8.3.

You could set up those machines to connect via trust.  But yeah,
dblink otherwise has passwords in the connect string.



From tgl@sss.pgh.pa.us Tue Aug  24 19:40:45 2010
Received: from maia.hub.org (maia-2.hub.org [200.46.204.251])
	by mail.postgresql.org (Postfix) with ESMTP id 890CF63305B
	for <pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 24 Aug 2010 16:40:45 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by maia.hub.org (mx1.hub.org [200.46.204.251]) (amavisd-maia,
	port 10024) with ESMTP id 80997-09 for
	<pgsql-admin-postgresql.org@mail.postgresql.org>;
	Tue, 24 Aug 2010 19:40:37 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130])
	by mail.postgresql.org (Postfix) with ESMTP id B5253632FFD
	for <pgsql-admin@postgresql.org>; Tue, 24 Aug 2010 16:40:37 -0300 (ADT)
Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1])
	by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id o7OJeZnr003754;
	Tue, 24 Aug 2010 15:40:35 -0400 (EDT)
To: Scott Marlowe <scott.marlowe@gmail.com>
cc: Keith Pinnix <kpinnix@yahoo.com>, pgsql-admin@postgresql.org
Subject: Re: postgresql 8.3 logging user passwords in clear text 
In-reply-to: <AANLkTin+RnK=K0tONO0M+q9xtfqgLdEx-1TwvELO7VwX@mail.gmail.com> 
References: <624891.14568.qm@web36907.mail.mud.yahoo.com>
	<AANLkTikTa-_86i9umBEY5yFCnT5emr=n4mJhNG1knvzx@mail.gmail.com>
	<521611.74185.qm@web36904.mail.mud.yahoo.com>
	<AANLkTin+RnK=K0tONO0M+q9xtfqgLdEx-1TwvELO7VwX@mail.gmail.com>
Comments: In-reply-to Scott Marlowe <scott.marlowe@gmail.com>
	message dated "Tue, 24 Aug 2010 13:01:51 -0600"
Date: Tue, 24 Aug 2010 15:40:35 -0400
Message-ID: <3753.1282678835@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-1.91 tagged_above=-10 required=5 tests=BAYES_00=-1.9,
	T_RP_MATCHES_RCVD=-0.01
X-Spam-Level: 
X-Archive-Number: 201008/192
X-Sequence-Number: 35441

Scott Marlowe <scott.marlowe@gmail.com> writes:
> On Tue, Aug 24, 2010 at 12:20 PM, Keith Pinnix <kpinnix@yahoo.com> wrote:
>> The entries are from dblimk something like below:
>>  SELECT * FROM dblink('dbname=XXXXXX  host=XXXXXX port=XXX  user=XXXXX
>> password=XXXXXXX ',

> You could set up those machines to connect via trust.  But yeah,
> dblink otherwise has passwords in the connect string.

Actually, the general opinion on this is that the postmaster log files
have to be protected because they might contain sensitive data;
*especially* so if you're enabling log_statements, but even without
that.  dblink passwords are just one small manifestation of the general
problem.  As an example, you might be inserting customers' credit card
numbers or some such into your tables.  Even if the log_statement
mechanism understood that it should hide passwords, it's hardly likely
to know that specific bits of ordinary data have security implications.

IOW: you're trying to fix this in the wrong place.  Secure your
logfiles, don't imagine that you can prevent there being any sensitive
info in them.

			regards, tom lane