doc: warn about security issues around log files

Reported-by: Simon Riggs
Discussion: https://postgr.es/m/CANP8+jJESuuXYq9Djvf-+tx2vY2OFLmfEuu+UvwHNJ1RT7iJCQ@mail.gmail.com

Author: Simon Riggs

Backpatch-through: 10

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 7e0c422ec9a39ffd7386279a334b8aaacaa01ac9..8bce230da00d9f331f289576671b13912c8f2ce9 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -6501,6 +6501,13 @@ local0.*    /var/log/postgresql
      
      What to Log
 
+     
+      
+       What you choose to log can have security implications;  see
+       .
+      
+     
+
      
 
      
@@ -7017,6 +7024,10 @@ log_line_prefix = '%m [%p] %q%u@%d/%a '
          planning).  Set log_min_error_statement to
          ERROR (or lower) to log such statements.
         
+        
+         Logged statements might reveal sensitive data and even contain
+         plaintext passwords.
+        
        
       
      

diff --git a/doc/src/sgml/maintenance.sgml b/doc/src/sgml/maintenance.sgml
index e249971a5134c4ce4fc4bcb087de61cbdba9e97a..802fe460637fbca5c3aeed30b3f5e8f969d84729 100644 (file)
--- a/doc/src/sgml/maintenance.sgml
+++ b/doc/src/sgml/maintenance.sgml
@@ -958,7 +958,25 @@ analyze threshold = analyze base threshold + analyze scale factor * number of tu
    It is a good idea to save the database server's log output
    somewhere, rather than just discarding it via /dev/null.
    The log output is invaluable when diagnosing
-   problems.  However, the log output tends to be voluminous
+   problems.
+  
+
+  
+   
+    The server log can contain sensitive information and needs to be protected,
+    no matter how or where it is stored, or the destination to which it is routed.
+    For example, some DDL statements might contain plaintext passwords or other
+    authentication details. Logged statements at the ERROR
+    level might show the SQL source code for applications
+    and might also contain some parts of data rows. Recording data, events and
+    related information is the intended function of this facility, so this is
+    not a leakage or a bug. Please ensure the server logs are visible only to
+    appropriately authorized people.
+   
+  
+
+  
+   Log output tends to be voluminous
    (especially at higher debug levels) so you won't want to save it
    indefinitely.  You need to rotate the log files so that
    new log files are started and old ones removed after a reasonable