Password masking

[dealproc]

What is the state of capabilities for NLog to mask passwords as part of writing to the different sinks? Is it something that the application author is responsible for, or is there room for extension of the logging framework to provide for this?

[304NotModified]

This is currently not possible out of the box, but I think you can implement it in a few lines - depending on the case.

[UgurAldanmaz]

What do you mean with password masking? Passwords that in the NLog configuration, or log outputs that contains sensitive data like password, or another?

[304NotModified]

Good question @UgurAldanmaz , I assumed the latter.

[dealproc]

If I push a message into the pipeline of NLog, and attach an exception to it. Anything that is pushed out to any logger would not show password={my super secret password from my connection string}; or "password": "super secret password my user submitted"

Not sure how to explain this further.

[304NotModified]

You can use the replace layout renderer for that (with regex)

https://github.com/NLog/NLog/wiki/Replace-Layout-Renderer

[dealproc]

Can you please provide an example of setting this layout up? How would it work for dumping stack traces, inner exceptions, etc. I'm not replacing the password= portion of password=mysecretpassword, i'm trying to make it look like password=****** in these scenarios.

[bhaeussermann]

How about using a regex lookbehind and lookahead? Maybe something like (?<=password=').*?(?=')

[bhaeussermann]

@dealproc Did it work?

[dealproc]

got side tracked. trying to get to vs2015, but will get back to this shortly.

[304NotModified]

OK,

The regex (?<=password=').*?(?=') works, but it needs then quotes. E.g. password='mysecretpassword'. password=mysecretpassword wont work. Not sure if that's correct.

You need after all something like this: (< needs to be replaced)

${replace:searchFor=(?<=password=').*?(?='):replaceWith=******:regex=true:inner=${message}}

If there performance is important, I would advise to write a custom replace which doesn't use a regex.

[bhaeussermann]

If the password is not surrounded by quotes, but followed by a semicolon, you can try (?<=password=).*?(?=;)

[304NotModified]

@dealproc any success on this?

[304NotModified]

Let us know if this is still an issue.

[excelthoughts]

I know this is an old thread.. but it's the only one on this masking issue.

I want to be able to search for a JSON formatted key value pair and apply masking.
Key/value pairs are both in double quotes and separated by a colon.

{"members":[{"password":"139347","Id":55}]}
want to convert to {"members":[{"password":"******","Id":55}]}

I assume double quotes need to be escaped like this (")

${replace:searchFor=(?<="password":").*?(?="):replaceWith=******:regex=true:inner=${message}

[]http://www.convertstring.com/EncodeDecode/HtmlDecode# tells me that I have the syntax correct:
Converts to:

${replace:searchFor=(?<="password":").*?(?="):replaceWith=******:regex=true:inner=${message}

However the replace layout renderer replaces the entire message with blank.

[excelthoughts]

@304NotModified Are you able to reopen this issue, or do you want to start another thread?

[304NotModified]

please a new issue and link to this one, thanks!

[search8]

I know this is an old thread but maybe this is helpful to someone. I have created this pattern primarily to remove passwords in connections strings (but could also be easily adjusted to match other/similar patterns):

It replaces passwords in the following format:

Case-insensitive password variable:

Password=myPassword
password=myPassword

Different line endings:

Password=myPassword (with nothing to follow)
Password=myPassword; (followed by semicolon)
Password=myPassword this a continuation (followed by space)

This is the pattern I have used: (?i)(?<=password=)(.*?)(?=(\;|$| ))
I used this to test it against: https://regex101.com/

This is what it translates to in an NLog variable:

<variable name="replacePasswords" value="${replace:searchFor=(?i)(?&lt;=password=)(.*?)(?=(\;|$| )):replaceWith=******:regex=true:inner=${message}}" />

And this is how I used it as part of my Database logger:

<parameter name="@Message" layout="${replacePasswords}" />

Hope this helps.

[snakefoot]

Alternative you could ensure that the sensitive-data is encapsulated in a custom class/struct. Ex. class SensitiveInformation.

Then let the class implement IFormattable and ensure that ToString() returns an obfuscated version of the truth.

Alternative one can make use of RegisterObjectTransformation for the custom class SensitiveInformation.

[andygarratt]

@excelthoughts Did you manage to resolve your issue with the entire message being blank, I have exactly the same issue :(

[304NotModified]

@andygarratt your regex is maybe wrong? Please test, for example on https://regex101.com

[fmarchetti88]

I know this is an old thread but maybe this is helpful to someone. I have created this pattern primarily to remove passwords in connections strings (but could also be easily adjusted to match other/similar patterns):

It replaces passwords in the following format:

Case-insensitive password variable:

Password=myPassword
password=myPassword

Different line endings:

Password=myPassword (with nothing to follow)
Password=myPassword; (followed by semicolon)
Password=myPassword this a continuation (followed by space)

This is the pattern I have used: (?i)(?<=password=)(.*?)(?=(\;|$| )) I used this to test it against: https://regex101.com/

This is what it translates to in an NLog variable:

<variable name="replacePasswords" value="${replace:searchFor=(?i)(?&lt;=password=)(.*?)(?=(\;|$| )):replaceWith=******:regex=true:inner=${message}}" />

And this is how I used it as part of my Database logger:

<parameter name="@Message" layout="${replacePasswords}" />

Hope this helps.

This is very helpful for me but i have a scenario where the logs can have password row logs like this:

Password=myPassword
Password:myPassword
"Password":myPassword

In other words, in addition to the equal (=) character, I could have the password string followed by a colon (:) or double quote ("). I tried to modify the regex in this way (?i)(?<=password[=:"]{1})(.*?)(?=(\;|$| )) and i succesfully tested it on https://regex101.com/ (it work for all my cases) but it doesn't work when i set as variable in my NLog.config. Someone can help me?

[304NotModified]

I guess you need to xml escape it. Or set it from code (e.g. C#)