From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: chaolpan@cisco.com
Subject: BUG #17338: pgaudit ddl audit logging show clear text password when create user mapping
Date: Thu, 16 Dec 2021 06:12:11 +0000
Message-ID: <17338-36d29597b910398f@postgresql.org> (raw)
The following bug has been logged on the website:
Bug reference: 17338
Logged by: James Pang
Email address: chaolpan@cisco.com
PostgreSQL version: 13.4
Operating system: RHEL8.4
Description:
pgaudit.log_catalog='on'
pgaudit.log_level='log'
pgaudit.log_parameter=on
pgaudit.log_statement_once=off
pgaudit.log='all, -misc'
pgaudit.log='ddl,role'
when create user jamet password 'testfdwpass';
audit log looks fine ,
2021-12-16 06:09:54.728 UTC:[local]:postgres@jamet:[67011]:[3-1]:2021-12-16
06:09:35 UTC:psqlLOG: AUDIT: SESSION,1,1,ROLE,CREATE ROLE,,,create user
jamet password <REDACTED>,<none>
but when create user mapping for fdw , it show clear text password in
OPTIONS(user 'jamet', password '...')
CREATE USER MAPPING FOR jamet SERVER foreign_server OPTIONS (user 'jamet',
password 'testfdwpass');
AUDIT: SESSION,1,1,DDL,CREATE USER MAPPING,USER MAPPING,jamet on server
foreign_server,"CREATE USER MAPPING FOR jamet SERVER foreign_server OPTIONS
(user 'jamet', password 'testfdwpass');"
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, chaolpan@cisco.com
Subject: Re: BUG #17338: pgaudit ddl audit logging show clear text password when create user mapping
In-Reply-To: <17338-36d29597b910398f@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox