Thread: password leak in mylog thru win odbc

password leak in mylog thru win odbc

From
"pg"
Date:
I'm using Win ME. I'm trying to write a program in VB and connects to PG
with super-user account (or with a "connection user" with many rights). The
detail user rights are embeded in the VB program for detail control, so that
no one should know the connection user. Users only knows their own password
for that VB program, so their password is only useful with that VB program.

But if a user enable the mylog in odbc, the password (pwd) shows up there in
mylogxxxxx.

What can I do to hide the password?

-Jason


Re: password leak in mylog thru win odbc

From
Chris Gamache
Date:
Several suggestions:

Use a different authentication method like Ident... That won't work if you've
already implimented a widespread password authentication system, though.

Modify the code to the ODBC driver to obscure the password from logs. That
might make it hard to troubleshoot authentication issues, though. It also won't
help if you're distributing this application. All the user would have to do is
to install a different pgodbc driver without the obscured logfiles, and you're
back to square one.

Upgrade to Windows 2000/XP and put the logfile in a directory with write-only
access for the system account that ODBC runs under (system I think... don't
take my word for it, though) and only allow reading by administrator or your
super user account... That won't help if you're distributing an application.

Ditch ODBC altogether and use pgExpress from www.vitavoom.com. It uses libpq
for native access to PostgreSQL. There are no hooks for the user to get into
there, AFAIK...

HTH,

CG


--- pg <pg@newhonest.com> wrote:
> I'm using Win ME. I'm trying to write a program in VB and connects to PG
> with super-user account (or with a "connection user" with many rights). The
> detail user rights are embeded in the VB program for detail control, so that
> no one should know the connection user. Users only knows their own password
> for that VB program, so their password is only useful with that VB program.
>
> But if a user enable the mylog in odbc, the password (pwd) shows up there in
> mylogxxxxx.
>
> What can I do to hide the password?
>
> -Jason
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Don't 'kill -9' the postmaster


__________________________________________________
Do you Yahoo!?
Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop!
http://platinum.yahoo.com

Re: password leak in mylog thru win odbc

From
"pg"
Date:
Thank you for your suggestion.
1. Does the pgExpress work with VB?
2. Should the commonly used win 32 ODBC consider some way to stop the leak
I'm talking about? My suggestion : mylog can be enabled only when the user
(the one who wants to enable the log) has the rights at the server side. So
each connection will has different rights and mylogs.

-Jason

----- Original Message -----
From: "Chris Gamache" <cgg007@yahoo.com>
To: "pg" <pg@newhonest.com>; <pgsql-odbc@postgresql.org>
Sent: Wednesday, March 19, 2003 11:31 PM
Subject: Re: [ODBC] password leak in mylog thru win odbc


> Several suggestions:
>
> Use a different authentication method like Ident... That won't work if
you've
> already implimented a widespread password authentication system, though.
>
> Modify the code to the ODBC driver to obscure the password from logs. That
> might make it hard to troubleshoot authentication issues, though. It also
won't
> help if you're distributing this application. All the user would have to
do is
> to install a different pgodbc driver without the obscured logfiles, and
you're
> back to square one.
>
> Upgrade to Windows 2000/XP and put the logfile in a directory with
write-only
> access for the system account that ODBC runs under (system I think...
don't
> take my word for it, though) and only allow reading by administrator or
your
> super user account... That won't help if you're distributing an
application.
>
> Ditch ODBC altogether and use pgExpress from www.vitavoom.com. It uses
libpq
> for native access to PostgreSQL. There are no hooks for the user to get
into
> there, AFAIK...
>
> HTH,
>
> CG
>
>
> --- pg <pg@newhonest.com> wrote:
> > I'm using Win ME. I'm trying to write a program in VB and connects to PG
> > with super-user account (or with a "connection user" with many rights).
The
> > detail user rights are embeded in the VB program for detail control, so
that
> > no one should know the connection user. Users only knows their own
password
> > for that VB program, so their password is only useful with that VB
program.
> >
> > But if a user enable the mylog in odbc, the password (pwd) shows up
there in
> > mylogxxxxx.
> >
> > What can I do to hide the password?
> >
> > -Jason
> >
> >
> > ---------------------------(end of broadcast)---------------------------
> > TIP 4: Don't 'kill -9' the postmaster
>
>
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop!
> http://platinum.yahoo.com
>


Re: password leak in mylog thru win odbc

From
Chris Gamache
Date:
--- pg <pg@newhonest.com> wrote:
> Thank you for your suggestion.
> 1. Does the pgExpress work with VB?

My mistake... It is a Delphi dbExpress component. There is a native access
ActiveX component distributed by dbExperts (www.dbExperts.net) with their
dbExperts PostgreSQL. I believe it is a single threaded ActiveX .dll, which
would preclude using it in a server environment. However, in a single user
environment (one or many single-client applications, all running on seperate
machines, connecting to one back-end database), it might do the trick.

> 2. Should the commonly used win 32 ODBC consider some way to stop the leak
> I'm talking about? My suggestion : mylog can be enabled only when the user
> (the one who wants to enable the log) has the rights at the server side. So
> each connection will has different rights and mylogs.

ODBC is strictly a client-side interface protocol. Its logging functions
originate and terminate on the client side. In some cases, ODBC is used
serverside as a client interface. If the user has control over the ODBC
component, then they have control over its logging functions. Without knowing
your network architecture, and the proposed deployment for your application,
the best that I can suggest is to not use ODBC, and use a native interface or
another middle-tier solution that meets your specifications.

>
> -Jason
>
> ----- Original Message -----
> From: "Chris Gamache" <cgg007@yahoo.com>
> To: "pg" <pg@newhonest.com>; <pgsql-odbc@postgresql.org>
> Sent: Wednesday, March 19, 2003 11:31 PM
> Subject: Re: [ODBC] password leak in mylog thru win odbc
>
>
> > Several suggestions:
> >
> > Use a different authentication method like Ident... That won't work if
> you've
> > already implimented a widespread password authentication system, though.
> >
> > Modify the code to the ODBC driver to obscure the password from logs. That
> > might make it hard to troubleshoot authentication issues, though. It also
> won't
> > help if you're distributing this application. All the user would have to
> do is
> > to install a different pgodbc driver without the obscured logfiles, and
> you're
> > back to square one.
> >
> > Upgrade to Windows 2000/XP and put the logfile in a directory with
> write-only
> > access for the system account that ODBC runs under (system I think...
> don't
> > take my word for it, though) and only allow reading by administrator or
> your
> > super user account... That won't help if you're distributing an
> application.
> >
> > Ditch ODBC altogether and use pgExpress from www.vitavoom.com. It uses
> libpq
> > for native access to PostgreSQL. There are no hooks for the user to get
> into
> > there, AFAIK...
> >
> > HTH,
> >
> > CG
> >
> >
> > --- pg <pg@newhonest.com> wrote:
> > > I'm using Win ME. I'm trying to write a program in VB and connects to PG
> > > with super-user account (or with a "connection user" with many rights).
> The
> > > detail user rights are embeded in the VB program for detail control, so
> that
> > > no one should know the connection user. Users only knows their own
> password
> > > for that VB program, so their password is only useful with that VB
> program.
> > >
> > > But if a user enable the mylog in odbc, the password (pwd) shows up
> there in
> > > mylogxxxxx.
> > >
> > > What can I do to hide the password?
> > >
> > > -Jason
> > >
> > >
> > > ---------------------------(end of broadcast)---------------------------
> > > TIP 4: Don't 'kill -9' the postmaster
> >
> >
> > __________________________________________________
> > Do you Yahoo!?
> > Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop!
> > http://platinum.yahoo.com
> >
>


__________________________________________________
Do you Yahoo!?
Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop!
http://platinum.yahoo.com

Re: password leak in mylog thru win odbc

From
"Dave Page"
Date:

> -----Original Message-----
> From: pg [mailto:pg@newhonest.com]
> Sent: 19 March 2003 06:22
> To: pgsql-odbc@postgresql.org
> Subject: [ODBC] password leak in mylog thru win odbc
>
> But if a user enable the mylog in odbc, the password (pwd)
> shows up there in mylogxxxxx.
>
> What can I do to hide the password?

Hi Jason,

If you use MD5 password authentication, does it still save the password
in the log, or the MD5 hash? If the latter, is that secure enough for
you, or might your users make use of it?

Regards, Dave.


Re: password leak in mylog thru win odbc

From
"pg"
Date:
Hi Dave,

Here is part of the mylogxxx with md5 in pg_hba.conf (user : test1, password
: test 1 from pgadmin2) :

==========
[-892929]globals.extra_systable_prefixes = 'dd_;'
[-892929][SQLAllocEnv][-892929]**** in PGAPI_AllocEnv **
[-892929]** exit PGAPI_AllocEnv: phenv = 72945392 **
[-892929][SQLAllocConnect][-892929]PGAPI_AllocConnect: entering...
[-892929]**** PGAPI_AllocConnect: henv = 72945392, conn = 71844416
[-892929]EN_add_connection: self = 72945392, conn = 71844416
[-892929]       added at i =0, conn->henv = 72945392, conns[i]->henv =
72945392
[-892929][SQLGetInfo][-892929]PGAPI_GetInfo: entering...fInfoType=77
[-892929]PGAPI_GetInfo: p='02.50', len=0, value=0, cbMax=12
[-892929][SQLSetConnectionOption][-892929]PGAPI_SetConnectOption: entering
fOption = 103 vParam = 15
[-892929][SQLDriverConnect][-892929]PGAPI_DriverConnect: entering...
[-892929]**** PGAPI_DriverConnect: fDriverCompletion=0,
connStrIn='DRIVER={PostgreSQL};UID=test1;PWD=test1;SERVER=192.168.1.103;PORT
=5432;DATABASE=template1;READONLY=0;PROTOCOL=6.4;FAKEOIDINDEX=0;SHOWOIDCOLUM
N=0;ROWVERSIONING=0;SHOWSYSTEMTABLES=0;CONNSETTINGS=;FETCH=100;SOCKET=4096;U
NKNOWNSIZES=0;MAXVARCHARSIZE=254;MAXLONGVARCHARSIZE=65536;OPTIMIZER=1;KSQO=1
;USEDECLAREFETCH=0;TEXTASLONGVARCHAR=1;UNKNOWNSASLONGVARCHAR=1;BOOLSASCHAR=1
;PARSE=0;CANCELASFREESTMT=0;EXTRASYSTABLEPREFIXES=dd_;COMMLOG=0;DEBUG=0;'
[-892929]our_connect_string =
'DRIVER={PostgreSQL};UID=test1;PWD=test1;SERVER=192.168.1.103;PORT=5432;DATA
BASE=template1;READONLY=0;PROTOCOL=6.4;FAKEOIDINDEX=0;SHOWOIDCOLUMN=0;ROWVER
SIONING=0;SHOWSYSTEMTABLES=0;CONNSETTINGS=;FETCH=100;SOCKET=4096;UNKNOWNSIZE
S=0;MAXVARCHARSIZE=254;MAXLONGVARCHARSIZE=65536;OPTIMIZER=1;KSQO=1;USEDECLAR
EFETCH=0;TEXTASLONGVARCHAR=1;UNKNOWNSASLONGVARCHAR=1;BOOLSASCHAR=1;PARSE=0;C
ANCELASFREESTMT=0;EXTRASYSTABLEPREFIXES=dd_;COMMLOG=0;DEBUG=0;'
[-892929]attribute = 'DRIVER', value = '{PostgreSQL}'
[-892929]copyAttributes:
DSN='',server='',dbase='',user='',passwd='',port='',onlyread='',protocol='',
conn_settings='',disallow_premature=-1)
[-892929]attribute = 'UID', value = 'test1'
[-892929]copyAttributes:
DSN='',server='',dbase='',user='test1',passwd='',port='',onlyread='',protoco
l='',conn_settings='',disallow_premature=-1)
[-892929]attribute = 'PWD', value = 'test1'
.....
=================

-Jason

----- Original Message -----
From: "Dave Page" <dpage@vale-housing.co.uk>
To: "pg" <pg@newhonest.com>; <pgsql-odbc@postgresql.org>
Sent: Friday, March 21, 2003 5:37 AM
Subject: Re: [ODBC] password leak in mylog thru win odbc


>
>
> > -----Original Message-----
> > From: pg [mailto:pg@newhonest.com]
> > Sent: 19 March 2003 06:22
> > To: pgsql-odbc@postgresql.org
> > Subject: [ODBC] password leak in mylog thru win odbc
> >
> > But if a user enable the mylog in odbc, the password (pwd)
> > shows up there in mylogxxxxx.
> >
> > What can I do to hide the password?
>
> Hi Jason,
>
> If you use MD5 password authentication, does it still save the password
> in the log, or the MD5 hash? If the latter, is that secure enough for
> you, or might your users make use of it?
>
> Regards, Dave.
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 5: Have you checked our extensive FAQ?
>
> http://www.postgresql.org/docs/faqs/FAQ.html
>


Re: password leak in mylog thru win odbc

From
Hiroshi Inoue
Date:
pg wrote:
>
> I'm using Win ME. I'm trying to write a program in VB and connects to PG
> with super-user account (or with a "connection user" with many rights). The
> detail user rights are embeded in the VB program for detail control, so that
> no one should know the connection user. Users only knows their own password
> for that VB program, so their password is only useful with that VB program.
>
> But if a user enable the mylog in odbc, the password (pwd) shows up there in
> mylogxxxxx.
>
> What can I do to hide the password?

Please try the snapshot dll at
http://www.geocities.jp/inocchichichi/psqlodbc/ .

regards,
Hiroshi Inoue
    http://www.geocities.jp/inocchichichi/psqlodbc/

Re: password leak in mylog thru win odbc

From
"pg"
Date:
Thank you Hiroshi. Part of the log is using "xxxx" as pwd, but the
connecting string still has the password

Mylog as follows :

=============
[-637877]globals.extra_systable_prefixes = 'dd_;'
[-637877]aszKey='DSN', value='PostgreSQL'
[-637877]copyAttributes:
DSN='PostgreSQL',server='',dbase='',user='',passwd='xxxxx',port='',onlyread=
'',protocol='',conn_settings='',disallow_premature=-1)
[-637877]globals.extra_systable_prefixes = 'dd_;'
[-102935185]globals.extra_systable_prefixes = 'dd_;'
[-102935185][SQLAllocEnv][-102935185]**** in PGAPI_AllocEnv **
[-102935185]** exit PGAPI_AllocEnv: phenv = 72945392 **
[-102935185][SQLAllocConnect][-102935185]PGAPI_AllocConnect: entering...
[-102935185]**** PGAPI_AllocConnect: henv = 72945392, conn = 71844416
[-102935185]EN_add_connection: self = 72945392, conn = 71844416
[-102935185]       added at i =0, conn->henv = 72945392, conns[i]->henv =
72945392
[-102935185][SQLGetInfo][-102935185]PGAPI_GetInfo: entering...fInfoType=77
[-102935185]PGAPI_GetInfo: p='02.50', len=0, value=0, cbMax=12
[-102935185][SQLSetConnectionOption][-102935185]PGAPI_SetConnectOption:
entering fOption = 103 vParam = 15
[-102935185][SQLDriverConnect][-102935185]PGAPI_DriverConnect: entering...
[-102935185]**** PGAPI_DriverConnect: fDriverCompletion=0,
connStrIn='DRIVER={PostgreSQL};UID=test1;PWD=test1;SERVER=192.168.1.103;PORT
=5432;DATABASE=template1;READONLY=0;PROTOCOL=6.4;FAKEOIDINDEX=0;SHOWOIDCOLUM
N=0;ROWVERSIONING=0;SHOWSYSTEMTABLES=0;CONNSETTINGS=;FETCH=100;SOCKET=4096;U
NKNOWNSIZES=0;MAXVARCHARSIZE=254;MAXLONGVARCHARSIZE=65536;OPTIMIZER=1;KSQO=1
;USEDECLAREFETCH=0;TEXTASLONGVARCHAR=1;UNKNOWNSASLONGVARCHAR=1;BOOLSASCHAR=1
;PARSE=0;CANCELASFREESTMT=0;EXTRASYSTABLEPREFIXES=dd_;COMMLOG=0;DEBUG=0;'
[-102935185]our_connect_string =
'DRIVER={PostgreSQL};UID=test1;PWD=test1;SERVER=192.168.1.103;PORT=5432;DATA
BASE=template1;READONLY=0;PROTOCOL=6.4;FAKEOIDINDEX=0;SHOWOIDCOLUMN=0;ROWVER
SIONING=0;SHOWSYSTEMTABLES=0;CONNSETTINGS=;FETCH=100;SOCKET=4096;UNKNOWNSIZE
S=0;MAXVARCHARSIZE=254;MAXLONGVARCHARSIZE=65536;OPTIMIZER=1;KSQO=1;USEDECLAR
EFETCH=0;TEXTASLONGVARCHAR=1;UNKNOWNSASLONGVARCHAR=1;BOOLSASCHAR=1;PARSE=0;C
ANCELASFREESTMT=0;EXTRASYSTABLEPREFIXES=dd_;COMMLOG=0;DEBUG=0;'
[-102935185]attribute = 'DRIVER', value = '{PostgreSQL}'
[-102935185]copyAttributes:
DSN='',server='',dbase='',user='',passwd='xxxxx',port='',onlyread='',protoco
l='',conn_settings='',disallow_premature=-1)
[-102935185]attribute = 'UID', value = 'test1'
[-102935185]copyAttributes:
DSN='',server='',dbase='',user='test1',passwd='xxxxx',port='',onlyread='',pr
otocol='',conn_settings='',disallow_premature=-1)
[-102935185]attribute = 'PWD', value = 'xxxxx'
[-102935185]copyAttributes:
DSN='',server='',dbase='',user='test1',passwd='xxxxx',port='',onlyread='',pr
otocol='',conn_settings='',disallow_premature=-1)
[-102935185]attribute = 'SERVER', value = '192.168.1.103'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='',user='test1',passwd='xxxxx',port='',o
nlyread='',protocol='',conn_settings='',disallow_premature=-1)
[-102935185]attribute = 'PORT', value = '5432'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='',user='test1',passwd='xxxxx',port='543
2',onlyread='',protocol='',conn_settings='',disallow_premature=-1)
[-102935185]attribute = 'DATABASE', value = 'template1'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='',protocol='',conn_settings='',disallow_premature=-1)
[-102935185]attribute = 'READONLY', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='',conn_settings='',disallow_premature=-1)
[-102935185]attribute = 'PROTOCOL', value = '6.4'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'FAKEOIDINDEX', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'SHOWOIDCOLUMN', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'ROWVERSIONING', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'SHOWSYSTEMTABLES', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'CONNSETTINGS', value = ''
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'FETCH', value = '100'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'SOCKET', value = '4096'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'UNKNOWNSIZES', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'MAXVARCHARSIZE', value = '254'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'MAXLONGVARCHARSIZE', value = '65536'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'OPTIMIZER', value = '1'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'KSQO', value = '1'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'USEDECLAREFETCH', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'TEXTASLONGVARCHAR', value = '1'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'UNKNOWNSASLONGVARCHAR', value = '1'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'BOOLSASCHAR', value = '1'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'PARSE', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'CANCELASFREESTMT', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'EXTRASYSTABLEPREFIXES', value = 'dd_'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'COMMLOG', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]attribute = 'DEBUG', value = '0'
[-102935185]copyAttributes:
DSN='',server='192.168.1.103',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-102935185]our_connect_string =
'DRIVER={PostgreSQL};UID=test1;PWD=test1;SERVER=192.168.1.103;PORT=5432;DATA
BASE=template1;READONLY=0;PROTOCOL=6.4;FAKEOIDINDEX=0;SHOWOIDCOLUMN=0;ROWVER
SIONING=0;SHOWSYSTEMTABLES=0;CONNSETTINGS=;FETCH=100;SOCKET=4096;UNKNOWNSIZE
S=0;MAXVARCHARSIZE=254;MAXLONGVARCHARSIZE=65536;OPTIMIZER=1;KSQO=1;USEDECLAR
EFETCH=0;TEXTASLONGVARCHAR=1;UNKNOWNSASLONGVARCHAR=1;BOOLSASCHAR=1;PARSE=0;C
ANCELASFREESTMT=0;EXTRASYSTABLEPREFIXES=dd_;COMMLOG=0;DEBUG=0;'
[-102935185]attribute = 'DRIVER', value = '{PostgreSQL}'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'UID', value = 'test1'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'PWD', value = 'xxxxx'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'SERVER', value = '192.168.1.103'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'PORT', value = '5432'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'DATABASE', value = 'template1'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'READONLY', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'PROTOCOL', value = '6.4'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'FAKEOIDINDEX', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'SHOWOIDCOLUMN', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'ROWVERSIONING', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'SHOWSYSTEMTABLES', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'CONNSETTINGS', value = ''
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'FETCH', value = '100'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'SOCKET', value = '4096'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'UNKNOWNSIZES', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'MAXVARCHARSIZE', value = '254'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=8190;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;C
0=0;C1=0;C2=dd_;[-102935185]attribute = 'MAXLONGVARCHARSIZE', value =
'65536'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'OPTIMIZER', value = '1'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'KSQO', value = '1'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'USEDECLAREFETCH', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'TEXTASLONGVARCHAR', value = '1'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=0;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'UNKNOWNSASLONGVARCHAR', value =
'1'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=1;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'BOOLSASCHAR', value = '1'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=1;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'PARSE', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=1;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'CANCELASFREESTMT', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=1;B9=1;
C0=0;C1=0;C2=dd_;[-102935185]attribute = 'EXTRASYSTABLEPREFIXES', value =
'dd_'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=1;B4=1;B5=1;B6=0;B7=1;B8=1;B9=1;
C0=0;C1=0;C2=dd_[-102935185]attribute = 'COMMLOG', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=1;B3=0;B4=1;B5=1;B6=0;B7=1;B8=1;B9=1;
C0=0;C1=0;C2=dd_[-102935185]attribute = 'DEBUG', value = '0'
[-102935185]CopyCommonAttributes:
A7=100;A8=4096;A9=0;B0=254;B1=65536;B2=0;B3=0;B4=1;B5=1;B6=0;B7=1;B8=1;B9=1;
C0=0;C1=0;C2=dd_
===============

-Jason

----- Original Message -----
From: "Hiroshi Inoue" <Inoue@tpf.co.jp>
To: "pg" <pg@newhonest.com>
Cc: <pgsql-odbc@postgresql.org>
Sent: Friday, March 21, 2003 1:13 PM
Subject: Re: [ODBC] password leak in mylog thru win odbc


> pg wrote:
> >
> > I'm using Win ME. I'm trying to write a program in VB and connects to PG
> > with super-user account (or with a "connection user" with many rights).
The
> > detail user rights are embeded in the VB program for detail control, so
that
> > no one should know the connection user. Users only knows their own
password
> > for that VB program, so their password is only useful with that VB
program.
> >
> > But if a user enable the mylog in odbc, the password (pwd) shows up
there in
> > mylogxxxxx.
> >
> > What can I do to hide the password?
>
> Please try the snapshot dll at
> http://www.geocities.jp/inocchichichi/psqlodbc/ .
>
> regards,
> Hiroshi Inoue
> http://www.geocities.jp/inocchichichi/psqlodbc/
>


Re: password leak in mylog thru win odbc

From
"Hiroshi Inoue"
Date:
> -----Original Message-----
> From: pg [mailto:pg@newhonest.com]
>
> Thank you Hiroshi. Part of the log is using "xxxx" as pwd, but the
> connecting string still has the password

OK Please retry the snapshot dll at
 http://www.geocities.jp/inocchichichi/psqlodbc/ .

regards,
Hiroshi Inoue
http://www.geocities.jp/inocchichichi/psqlodbc/


Re: password leak in mylog thru win odbc

From
"pg"
Date:
Thank you once again Hiroshi, it is working now. But I found that when I
changed the length of password, some "hidden" password showed the length of
the actual password, which might raise the leaking (or guessing) risk a
little bit. Part of Mylog as following (user = test1, password =
abcdefghijk) :

============
.....
[-600497]copyAttributes:
DSN='',server='192.168.1.100',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-600497]attribute = 'DEBUG', value = '0'
[-600497]copyAttributes:
DSN='',server='192.168.1.100',dbase='template1',user='test1',passwd='xxxxx',
port='5432',onlyread='0',protocol='6.4',conn_settings='',disallow_premature=
-1)
[-600497]our_connect_string =
'DRIVER={PostgreSQL};UID=test1;PWD=xxxxxxxxxxx;SERVER=192.168.1.100;PORT=543
2;DATABASE=template1;READONLY=0;PROTOCOL=6.4;FAKEOIDINDEX=0;SHOWOIDCOLUMN=0;
ROWVERSIONING=0;SHOWSYSTEMTABLES=0;CONNSETTINGS=;FETCH=100;SOCKET=4096;UNKNO
WNSIZES=0;MAXVARCHARSIZE=254;MAXLONGVARCHARSIZE=65536;OPTIMIZER=1;KSQO=1;USE
DECLAREFETCH=0;TEXTASLONGVARCHAR=1;UNKNOWNSASLONGVARCHAR=1;BOOLSASCHAR=1;PAR
SE=0;CANCELASFREESTMT=0;EXTRASYSTABLEPREFIXES=dd_;COMMLOG=0;DEBUG=0;'
[-600497]attribute = 'DRIVER', value = '{PostgreSQL}'
......
==========
some password='xxxxx' : the length is fixed to 5 digit.
but our_connect_string = .....PWD=xxxxxxxxxxx : which showed the actual
length of my password "abcdefghijk"
=============

-Jason

----- Original Message -----
From: "Hiroshi Inoue" <Inoue@tpf.co.jp>
To: "pg" <pg@newhonest.com>
Cc: <pgsql-odbc@postgresql.org>
Sent: Friday, March 21, 2003 11:50 PM
Subject: RE: [ODBC] password leak in mylog thru win odbc


> > -----Original Message-----
> > From: pg [mailto:pg@newhonest.com]
> >
> > Thank you Hiroshi. Part of the log is using "xxxx" as pwd, but the
> > connecting string still has the password
>
> OK Please retry the snapshot dll at
>  http://www.geocities.jp/inocchichichi/psqlodbc/ .
>
> regards,
> Hiroshi Inoue
> http://www.geocities.jp/inocchichichi/psqlodbc/
>
>