From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jeff Janes <jeff.janes@gmail.com>
cc: Stephen Frost <sfrost@snowman.net>, Magnus Hagander <magnus@hagander.net>,
        Thomas Munro <thomas.munro@gmail.com>, k.yudhveer@gmail.com,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: BUG #16079: Question Regarding the BUG #16064
In-reply-to: 
 <CAMkU=1w4c6NXiKHx-awVw0EeTqqn-Coy_hJGwYkq9WvbEQ1PAw@mail.gmail.com>
References: <16079-29e9c038e1463751@postgresql.org>
 <20191028154754.GS6962@tamriel.snowman.net>
 <CA+hUKGJw4Ax25=fcCA+DQD=82v2pKu9VGmkYZO8HeH7+-P2Cxw@mail.gmail.com>
 <CABUevEwMcFmXqPJgOQfnUV8XgKtWqHPiccNHY+mPJ0AfeFz-7Q@mail.gmail.com>
 <20201221005825.GQ16415@tamriel.snowman.net>
 <CAMkU=1w4c6NXiKHx-awVw0EeTqqn-Coy_hJGwYkq9WvbEQ1PAw@mail.gmail.com>
Comments: In-reply-to Jeff Janes <jeff.janes@gmail.com>
	message dated "Mon, 21 Dec 2020 12:26:17 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <543835.1608575492.1@sss.pgh.pa.us>
Date: Mon, 21 Dec 2020 13:31:32 -0500
Message-ID: <543836.1608575492@sss.pgh.pa.us>
Precedence: bulk

Jeff Janes <jeff.janes@gmail.com> writes:
> On Sun, Dec 20, 2020 at 7:58 PM Stephen Frost <sfrost@snowman.net> wrote:
>> * Magnus Hagander (magnus@hagander.net) wrote:
>>> Maybe we should do the same for LDAP (and RADIUS)? This seems like a
>>> better place to put it than to log it at every time it's received?

>> A dollar short and a year late, but ... +1.

> I would suggest going further.  I would make the change on the client side,
> and have libpq refuse to send unhashed passwords without having an
> environment variable set which allows it.

As noted, that would break LDAP and RADIUS auth methods; likely also PAM.

> What is the value of logging on the server side?

I do agree with this point, but mostly on the grounds of "nobody reads
the server log".

			regards, tom lane