Message-ID: <b9d9738794d77406fc3abe601658970381c67057.camel@cybertec.at>
Subject: Re: pg_stat_statements showing passwords while create or alter
 users.
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: chandu_munnu@yahoo.com, pgsql-docs@lists.postgresql.org
Date: Fri, 17 Apr 2020 09:01:12 +0200
In-Reply-To: <158708887722.25694.11400369619365749891@wrigleys.postgresql.org>
References: 
	<158708887722.25694.11400369619365749891@wrigleys.postgresql.org>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.32.5 (3.32.5-1.fc30) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Fri, 2020-04-17 at 02:01 +0000, PG Doc comments form wrote:
> pg_stat_statements is recording passwords also, is there any way to avoid
> the logging of passwords without droping extension package.
> testdb=> create user test1 with password 'test123';
> CREATE ROLE
> testdb=> create user test2 with encrypted password 'test123';
> CREATE ROLE
> test=> select query from pg_stat_statements where query like '%test%';
>                            query
> -----------------------------------------------------------
> create user test1 with encrypted password 'test123'
> create user test2 with password 'test123'

There is no way to obfuscate such passwords.
Note that these statements will also show up in the server log
if you set "log_statement = 'ddl'".

For these reasons it is recommended to never set your password like
this, but always hash it on the client side first.

Most interactive clients have a way to do that, like psql`s "\password".

Yours,
Laurenz Albe
-- 
Cybertec | https://www.cybertec-postgresql.com