agora inbox for [email protected]  

help / color / mirror / Atom feed

From: PG Bug reporting form <[email protected]>
To: [email protected]
Cc: [email protected]
Subject: BUG #18379: LDAP bind password exposed
Date: Wed, 06 Mar 2024 13:51:24 +0000
Message-ID: <[email protected]> (raw)

The following bug has been logged on the website:

Bug reference:      18379
Logged by:          Vinícius Coelho
Email address:      [email protected]
PostgreSQL version: 15.3
Operating system:   Ubuntu 22.04
Description:        

Dear PostgreSQL Support Team,

I am writing to seek your assistance regarding a security concern we have
encountered with our PostgreSQL database setup. We are currently utilizing
LDAP authentication as specified in our pg_hba.conf file. However, upon
reviewing the PostgreSQL logs, we have observed an issue that is causing us
significant concern.

Whenever a login attempt is made using LDAP authentication, the entire
configuration line from the pg_hba.conf file is being logged in the
PostgreSQL log files. This includes the LDAP bind password (ldapbindpasswd),
which is being recorded in plaintext. This practice poses a serious security
risk, as it exposes sensitive credentials in log files that might be
accessed by unauthorized individuals.

We are seeking guidance on how to address this issue. Specifically, we would
like to know:

If there is a configuration option available that prevents the logging of
sensitive information, particularly the LDAP bind password, in the
PostgreSQL logs.
Any recommended best practices for securing our LDAP authentication setup
with PostgreSQL, to avoid similar issues in the future.
If this behavior is known and if there are any patches or updates available
that we should apply to our PostgreSQL installation to resolve this
concern.
We prioritize the security of our database and the protection of sensitive
information. Therefore, we are eager to resolve this issue as promptly as
possible. Any assistance or insights you could provide on this matter would
be greatly appreciated.

Thank you in advance for your time and support. We look forward to your
prompt response and any recommendations you may have.

Best regards,
Vinícius Coelho

view thread (7+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: BUG #18379: LDAP bind password exposed
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox