pg_auto_failover icon indicating copy to clipboard operation
pg_auto_failover copied to clipboard

Refrain from using PGPASSWORD for pg_basebackup connection.

Open DimCitus opened this issue 4 years ago • 2 comments

Using the environment variable allows to omit the replication password from the logs, though messes with next connection attempts. We should either call unsetenv() once the pg_basebackup command has finished, or use the password on the connection string.

In this tentative PR we use the password in the connection string.

Should fix #766.

DimCitus avatar Jul 09 '21 13:07 DimCitus

Given my reading of the code I believe you've spotted a real problem with this attempt:

	args[argsIndex++] = primaryConnInfo;

        ...

	/* log the exact command line we're using */
	int commandSize = snprintf_program_command_line(&program, command, BUFSIZE);

Making it so that we don't include the password in the logs is going to require too much fiddling around, I suppose I should work on using unsetenv instead.

DimCitus avatar Nov 04 '21 14:11 DimCitus

I just pushed a better version of this fix, using unsetenv, or setenv again to the previous value of the PGPASSWORD environment variable if it happened to be already set before. Might be useful...

DimCitus avatar Nov 04 '21 14:11 DimCitus