doc: warn about security issues around log files

Reported-by: Simon Riggs
Discussion: https://postgr.es/m/CANP8+jJESuuXYq9Djvf-+tx2vY2OFLmfEuu+UvwHNJ1RT7iJCQ@mail.gmail.com

Author: Simon Riggs

Backpatch-through: 10

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index afe01fa4929fea9241755f4f353ddaef8d628f20..b4336c526688200f7a8ec111411bf6d41d98b3e8 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -6649,6 +6649,13 @@ local0.*    /var/log/postgresql
      
      What to Log
 
+     
+      
+       What you choose to log can have security implications;  see
+       .
+      
+     
+
      
 
      
@@ -7241,6 +7248,10 @@ log_line_prefix = '%m [%p] %q%u@%d/%a '
          planning).  Set log_min_error_statement to
          ERROR (or lower) to log such statements.
         
+        
+         Logged statements might reveal sensitive data and even contain
+         plaintext passwords.
+        
        
       
      

diff --git a/doc/src/sgml/maintenance.sgml b/doc/src/sgml/maintenance.sgml
index 693c92d9cba1bdb8f0c7be983bbe3eb7f6d563a5..eaffb5a65920e758d4eb10ad9d4d1c2b3914286e 100644 (file)
--- a/doc/src/sgml/maintenance.sgml
+++ b/doc/src/sgml/maintenance.sgml
@@ -958,7 +958,25 @@ analyze threshold = analyze base threshold + analyze scale factor * number of tu
    It is a good idea to save the database server's log output
    somewhere, rather than just discarding it via /dev/null.
    The log output is invaluable when diagnosing
-   problems.  However, the log output tends to be voluminous
+   problems.
+  
+
+  
+   
+    The server log can contain sensitive information and needs to be protected,
+    no matter how or where it is stored, or the destination to which it is routed.
+    For example, some DDL statements might contain plaintext passwords or other
+    authentication details. Logged statements at the ERROR
+    level might show the SQL source code for applications
+    and might also contain some parts of data rows. Recording data, events and
+    related information is the intended function of this facility, so this is
+    not a leakage or a bug. Please ensure the server logs are visible only to
+    appropriately authorized people.
+   
+  
+
+  
+   Log output tends to be voluminous
    (especially at higher debug levels) so you won't want to save it
    indefinitely.  You need to rotate the log files so that
    new log files are started and old ones removed after a reasonable