Masking passwords in PGWatch Logs

[tvecerakb]

Is your feature request related to a problem? Please describe.
No

Describe the solution you'd like

In the current version of PGWatch, the complete connection string for SINK databases, including the password, is logged during startup. For security reasons, it would be better to avoid logging passwords or to mask them.

[pashagolub]

as a temporary workaround it's better to use connection service file

[tvecera]

Thank you, I will try use connection service file.

[HangDazon]

May I know how to use connection file with connection string for SINK?

[pashagolub]

Oh, @tvecera, another solution would be to use .pgpass file: https://www.postgresql.org/docs/current/libpq-pgpass.html

[pashagolub]

@HangDazon

It's easier to use .pgpass file.

If one needs to use service file:

That service name can then be specified in a libpq connection string, and the associated settings will be used. This allows connection parameters to be modified without requiring a recompile of the libpq-using application. The service name can also be specified using the PGSERVICE environment variable.

So if you have a service file with service foo described, you can specify something like this:

pgwatch --sink=postgresql://?service=foo

[HangDazon]

@pashagolub , thank you I will try it in both ways.

[pashagolub]

@tvecera is the output on your screenshot produced by custom patched version by you? I see log messages are changed slightly

[tvecera]

No, it's a log from a K8S container running the original image: 3.0.0-beta6

[pashagolub]

oh, interesting. Can you confirm k8s lower cases all log messages?

[tvecera]

I’m not sure exactly how you mean "k8s lower cases", but generally no. The connection string is logged exactly as it appears in the configuration. In other words, if the password is in camel case, it is logged in camel case in the log.

[pashagolub]

in the source code log messages are capitalized but on your screenshow they are lower cased. But maybe there were some changes between beta6 and the current version