From: Tom Lane <tgl@sss.pgh.pa.us>
To: Matthias Apitz <guru@unixarea.de>
Cc: Indrajeeth Deshmukh <bkindrajeeth@gmail.com>
Cc: David Rowley <dgrowleyml@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18817: Security Bug Report: Plaintext Password Exposure in Logs
Date: Wed, 19 Feb 2025 01:30:18 -0500
Message-ID: <1951016.1739946618@sss.pgh.pa.us> (raw)
In-Reply-To: <Z7Vy4FefAH/Vk+Lc@pureos>
References: <18817-771682052a364bfe@postgresql.org>
<CAApHDvoCnaLeVO4zdCaYJFBfcuGXYz1W5L917p526nWEcs=gqg@mail.gmail.com>
<CAAapt1i2Mf=S0FtPz8Z9RNkez=nP50AcYDVC7Dm8r=cskMn7tg@mail.gmail.com>
<1241094.1739893072@sss.pgh.pa.us>
<Z7Vy4FefAH/Vk+Lc@pureos>
Matthias Apitz <guru@unixarea.de> writes:
> What do I have to configure in the PostgreSQL server to get this
> reproduced? I tried:
[ scratches head... ] Seems like you must be looking in the wrong
log file. It works for me:
$ psql postgres
psql (18devel)
Type "help" for help.
postgres=# set log_statement = 'all';
SET
postgres=# CREATE USER bla WITH PASSWORD 'bla';
CREATE ROLE
postgres=# \q
$ tail .../postmaster.log
...
2025-02-19 01:19:18.638 EST [1949443] LOG: statement: CREATE USER bla WITH PASSWORD 'bla';
If you're not running with log_statement = all, the most likely
scenario is a syntax error:
$ psql postgres
psql (18devel)
Type "help" for help.
postgres=# CREATE USER bla WITH PASWORD 'bla';
ERROR: unrecognized role option "pasword"
LINE 1: CREATE USER bla WITH PASWORD 'bla';
^
postgres=# \q
$ tail .../postmaster.log
...
2025-02-19 01:25:39.227 EST [1950440] ERROR: unrecognized role option "pasword" at character 22
2025-02-19 01:25:39.227 EST [1950440] STATEMENT: CREATE USER bla WITH PASWORD 'bla';
Of course, this command didn't do anything; but a person reading the
log would have a pretty strong clue what password you were about to
assign. (And contrarily, Postgres itself would have no clue that
'bla' might be something that needs hiding.)
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, guru@unixarea.de, bkindrajeeth@gmail.com, dgrowleyml@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18817: Security Bug Report: Plaintext Password Exposure in Logs
In-Reply-To: <1951016.1739946618@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox