From: Laurenz Albe <laurenz.albe@cybertec.at>
To: chandu_munnu@yahoo.com
To: pgsql-docs@lists.postgresql.org
Subject: Re: pg_stat_statements showing passwords while create or alter users.
Date: Fri, 17 Apr 2020 09:01:12 +0200
Message-ID: <b9d9738794d77406fc3abe601658970381c67057.camel@cybertec.at> (raw)
In-Reply-To: <158708887722.25694.11400369619365749891@wrigleys.postgresql.org>
References: <158708887722.25694.11400369619365749891@wrigleys.postgresql.org>
On Fri, 2020-04-17 at 02:01 +0000, PG Doc comments form wrote:
> pg_stat_statements is recording passwords also, is there any way to avoid
> the logging of passwords without droping extension package.
> testdb=> create user test1 with password 'test123';
> CREATE ROLE
> testdb=> create user test2 with encrypted password 'test123';
> CREATE ROLE
> test=> select query from pg_stat_statements where query like '%test%';
> query
> -----------------------------------------------------------
> create user test1 with encrypted password 'test123'
> create user test2 with password 'test123'
There is no way to obfuscate such passwords.
Note that these statements will also show up in the server log
if you set "log_statement = 'ddl'".
For these reasons it is recommended to never set your password like
this, but always hash it on the client side first.
Most interactive clients have a way to do that, like psql`s "\password".
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: laurenz.albe@cybertec.at, chandu_munnu@yahoo.com, pgsql-docs@lists.postgresql.org
Subject: Re: pg_stat_statements showing passwords while create or alter users.
In-Reply-To: <b9d9738794d77406fc3abe601658970381c67057.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox