Message-ID: <d3fe51d491e89b6a2946d8cc98a60e4d4b39c145.camel@cybertec.at>
Subject: Re: BUG #18817: Security Bug Report: Plaintext Password Exposure in
 Logs
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Matthias Apitz <guru@unixarea.de>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: Indrajeeth Deshmukh <bkindrajeeth@gmail.com>, David Rowley
	 <dgrowleyml@gmail.com>, pgsql-bugs@lists.postgresql.org
Date: Wed, 19 Feb 2025 09:58:17 +0100
In-Reply-To: <Z7Vy4FefAH/Vk+Lc@pureos>
References: <18817-771682052a364bfe@postgresql.org>
	 <CAApHDvoCnaLeVO4zdCaYJFBfcuGXYz1W5L917p526nWEcs=gqg@mail.gmail.com>
	 <CAAapt1i2Mf=S0FtPz8Z9RNkez=nP50AcYDVC7Dm8r=cskMn7tg@mail.gmail.com>
	 <1241094.1739893072@sss.pgh.pa.us> <Z7Vy4FefAH/Vk+Lc@pureos>
User-Agent: Evolution 3.54.3 (3.54.3-1.fc41) 
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: 
 <https://www.postgresql.org/message-id/d3fe51d491e89b6a2946d8cc98a60e4d4b39c145.camel%40cybertec.at>
Precedence: bulk

On Wed, 2025-02-19 at 06:57 +0100, Matthias Apitz wrote:
> What do I have to configure in the PostgreSQL server to get this
> reproduced? I tried:
>=20
> $ psql -Usisis testdb
> psql (15.1, server 16.5)
> WARNING: psql major version 15, server major version 16.
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Some psql features might=
 not work.
> Type "help" for help.
>=20
> testdb=3D# CREATE USER bla WITH PASSWORD 'bla';
> CREATE ROLE
> testdb=3D#
>=20
> and have nothing in the log:
>=20
> $ tail /data/postgresql165/log/postgresql-2025-02-19_000000.log
> ...
>=20
> 2025-02-19 06:15:23.582 CET [1947] LOG:=C2=A0 checkpoint complete: wrote =
1421 buffers (8.7%); 0 WAL file(s) added, 1 removed, 0 recycled; write=3D14=
2.168 s, sync=3D0.003 s, total=3D142.186 s; sync files=3D57, longest=3D0.00=
2 s, average=3D0.001 s; distance=3D18403 kB, estimate=3D18403 kB; lsn=3D5/7=
2470898, redo lsn=3D5/7246F048
>=20
> I even set=20
>=20
> log_statement =3D 'all'
>=20
> and restarted the server - nothing.

Setting "log_statement" to "all", "mod" or "ddl" would do the trick.
You must have made some basic mistake.

Look at "pg_settings" what your current setting for "log_statement" is
and where it is coming from.

> The purpose of my question is to inform our 50++ PostgreSQL customers
> what they must avoid...

I'd call that an unfair bias against your younger customers.

Yours,
Laurenz Albe

--=20

*E-Mail Disclaimer*
Der Inhalt dieser E-Mail ist ausschliesslich fuer den=20
bezeichneten Adressaten bestimmt. Wenn Sie nicht der vorgesehene Adressat=
=20
dieser E-Mail oder dessen Vertreter sein sollten, so beachten Sie bitte,=20
dass jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder=
=20
Weitergabe des Inhalts dieser E-Mail unzulaessig ist. Wir bitten Sie, sich=
=20
in diesem Fall mit dem Absender der E-Mail in Verbindung zu setzen.

*CONFIDENTIALITY NOTICE & DISCLAIMER
*This message and any attachment are=20
confidential and may be privileged or otherwise protected from disclosure=
=20
and solely for the use of the person(s) or entity to whom it is intended.=
=20
If you have received this message in error and are not the intended=20
recipient, please notify the sender immediately and delete this message and=
=20
any attachment from your system. If you are not the intended recipient, be=
=20
advised that any use of this message is prohibited and may be unlawful, and=
=20
you must not copy this message or attachment or disclose the contents to=20
any other person.