plaintext passwords in logs | Appsmith | Page 1

violet kite Apr 25, 2023, 6:10 PM

#

e.g.,
++ APPSMITH_MONGODB_URI=mongodb+srv://...

stable jasperBOT Apr 25, 2023, 6:15 PM

#

Hey There,

We've registered your query, and our team will get back to you soon.

Regards,
Pranav

stable jasperBOT Apr 25, 2023, 6:45 PM

#

Hello! Could you please elaborate on your use case and send some screenshots to
help us better understand what you are trying to achieve?

violet kite Apr 25, 2023, 7:32 PM

#

my use case is to run self-hosted appsmith in kubernetes without disclosing passwords in logs

#

kubectl logs -n conductor appsmith-fbc54544d-jndnw |grep -E "_(PASSWORD|URI)" |sed -E 's/=.*/=.../g'
++ APPSMITH_MAIL_PASSWORD=...
++ APPSMITH_MONGODB_URI=...
++ APPSMITH_MONGODB_PASSWORD=...
++ APPSMITH_ENCRYPTION_PASSWORD=...
++ APPSMITH_SUPERVISOR_PASSWORD=...
++ APPSMITH_MONGODB_URI=...
++ APPSMITH_KEYCLOAK_DB_PASSWORD=...

echo 'Checking APPSMITH_MONGODB_URI'
Checking APPSMITH_MONGODB_URI
KEYCLOAK_ADMIN_PASSWORD=...
export KEYCLOAK_ADMIN_PASSWORD
echo KEYCLOAK_ADMIN_PASSWORD=...
++ awk -F=...
APPSMITH_MAIL_PASSWORD=...
APPSMITH_MONGODB_URI=...
APPSMITH_MONGODB_PASSWORD=...
APPSMITH_ENCRYPTION_PASSWORD=...
APPSMITH_SUPERVISOR_PASSWORD=...
KEYCLOAK_ADMIN_PASSWORD=...
APPSMITH_MAIL_PASSWORD=...
APPSMITH_MONGODB_URI=...
APPSMITH_MONGODB_PASSWORD=...
APPSMITH_ENCRYPTION_PASSWORD=...
APPSMITH_SUPERVISOR_PASSWORD=...
KEYCLOAK_ADMIN_PASSWORD=...

#

dots by me, in actual logs those seem to be actual passwords

stable jasperBOT Apr 25, 2023, 7:53 PM

#

Which version of Appsmith are you using? Can you please send a copy of your logs
to [email protected] and include a link to this conversation in the email?

violet kite Apr 25, 2023, 8:03 PM

#

1.6.12. i would not want to send unredacted logs, is kind of my point

stable jasperBOT Apr 25, 2023, 8:57 PM

#

That's a very old version of Appsmith. We're currently on 1.9.16. I recommend
you upgrade to the latest version. Since you're so far behind, you'll need to
upgrade to our last checkpoint version, 1.9.2, and then update to the latest.
Please see this guide in our docs for more information:

https://docs.appsmith.com/getting-started/setup/instance-management/update-appsmith#upgrade-to-a-checkpoint-version

Update Appsmith | Appsmith

Follow the steps to update Appsmith to the latest version.

violet kite Apr 25, 2023, 9:23 PM

#

excuse me, 1.9.12

stable jasperBOT Apr 26, 2023, 5:00 AM

#

Ok. I am checking with the team on this.

#plaintext passwords in logs