Re: BUG #16451: .psql_history file shows clear text password.

From: Magnus Hagander <magnus(at)hagander(dot)net>
To: abcxiaod(at)126(dot)com, PostgreSQL mailing lists <pgsql-bugs(at)lists(dot)postgresql(dot)org>
Subject: Re: BUG #16451: .psql_history file shows clear text password.
Date: 2020-05-18 09:46:22
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-bugs

On Mon, May 18, 2020 at 11:42 AM PG Bug reporting form <
noreply(at)postgresql(dot)org> wrote:

> The following bug has been logged on the website:
> Bug reference: 16451
> Logged by: yi Ding
> Email address: abcxiaod(at)126(dot)com
> PostgreSQL version: 10.12
> Operating system: linux
> Description:
> bash-4.2# cat /home/postgres/.psql_history |grep password
> alter user t password 'adsf123asg';

Yes, if you intentionally send the query in clear text, it will be logged
in clear text.

Just like with your report about creating user, it is clearly documented in
the ALTER ROLE documentation that if you don't want this, you should use
\password or a similar functionality, and not the cleartext ALTER USER.

You can also turn off command line history in psql if you want, by running
it with -n.

Magnus Hagander
Me: <>
Work: <>

In response to

Browse pgsql-bugs by date

  From Date Subject
Next Message Magnus Hagander 2020-05-18 09:47:39 Re: BUG #16450: Recovery.conf file shows clear text password.
Previous Message Magnus Hagander 2020-05-18 09:45:13 Re: BUG #16449: Log file and the query field of the pg_stat_statements table display clear text password.