Date: Wed, 6 Mar 2024 13:40:26 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: coelho.viniciusdf@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18379: LDAP bind password exposed
Message-ID: <Zei4mtDc4s0LN6bR@tamriel.snowman.net>
References: <18379-385d04dcaa62d6fd@postgresql.org>
 <139544.1709739622@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="cHueemA4jM0n2zg2"
Content-Disposition: inline
In-Reply-To: <139544.1709739622@sss.pgh.pa.us>
User-Agent: Mutt/2.1.4 (2021-12-11)
Archived-At: 
 <https://www.postgresql.org/message-id/Zei4mtDc4s0LN6bR%40tamriel.snowman.net>
Precedence: bulk


--cHueemA4jM0n2zg2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> PG Bug reporting form <noreply@postgresql.org> writes:
> > Whenever a login attempt is made using LDAP authentication, the entire
> > configuration line from the pg_hba.conf file is being logged in the
> > PostgreSQL log files. This includes the LDAP bind password (ldapbindpas=
swd),
> > which is being recorded in plaintext. This practice poses a serious sec=
urity
> > risk, as it exposes sensitive credentials in log files that might be
> > accessed by unauthorized individuals.
>=20
> We do not consider this a bug.  There are very many ways that
> sensitive information could appear in the postmaster log file.
> There's no way to block them all, not least because some items
> are ones that the server could not know are sensitive (consider
> for instance credit card details, or medical information in a
> database under HIPAA rules).  You *must* make arrangements to
> secure the postmaster log equally carefully as the database itself.

While I agree that users should take steps to secure their log files,
I'd argue that it's best practice to avoid dumping sensitive data into
log files, which it seems like it would be in this case.  I'm not
suggesting that this is bug-worthy or that we should go to excessive
lengths to try and prevent every such case, but if someone showed up
with a reasonable patch to replace the sensitive information in a pg_hba
line with ****, I would be on the side of supporting that.

> Having said that, you might consider moving away from LDAP
> authentication.  It's not considered best practice anymore,
> notably because it requires the server to see the user's
> unencrypted password, and then turn around and pass that on
> to the LDAP server.  GSSAPI/SSPI (a/k/a Kerberos, or Active
> Directory in the Microsoft universe) provide substantially
> better centralized authentication technology that's more
> secure in quite a few ways.

Fully agree with this.  The best approach to dealing with this is to
move away from PG's 'ldap' auth type.

Thanks!

Stephen

--cHueemA4jM0n2zg2
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEwf6gbxKhD863zrx/7WyKOINHZFUFAmXouJcACgkQ7WyKOINH
ZFUwGw//UzDh3aKV67TIb/i0aCbvQNdDCOwyYENp8NXduG4NDgIpMYITZd60x3y9
yvDqQ7TuqpwWiDrjOFDZMd5vfSqNQJZy76m1/idxbCDcylVTGGGml6H+lGm9fqaP
QK/TR2Yk2D91kZO/FzE2GJzhOR7Gvo03lRmKXbJQSxZBuIXfxudCHrlbVP9knbd5
O2s58LMDfE5IMgXcaiboi/4o9sC2RTEQ3YjQO+P+eV9x3IGciA8GKQIeIe07H0R2
Mu5qj3793e0f1y1E7yfEgdFBvp76/fH2PRaMUnJ5xDe0iUbnb8Eqa2lQcJhiMrJS
h5NJT4d+toFl6fvUwzju3fFfcEObeFMeS/0tJzh3Z3EWz7+EX2KBMsPxXPsnK2jA
Zy5BOn7PGfhMpU2uPfgDpt6oKeGgudl9s0qqbGGqJbb7M+wItCt0Lz5R88B08U6U
sQeJ6VxLfEMGJZT+oe8gcURjI+02tRIR9TuJ3J/d8NtR1gafQSEsT5+7DifQioBa
xEceWqwysz0nw6TaOFeTDgxbFI4CHAFD4aNIW1hDPnxPImUhZ6UUOQeoo0pvu8Sq
dtOnCZE7m5rsdDVTpTdL2BCzFUl3A1TVzHdcy0cEccy+k6l294BYil3OGGyq2YJD
qq2nXNn8Bm/l8k4suKx+Q+bqJ3MqQC9Jst193vEaoZOlxSug7Fw=
=pTXX
-----END PGP SIGNATURE-----

--cHueemA4jM0n2zg2--