Skip to main content

SEC.CFG.GENERAL_LOG — Every statement is being written down, verbatim

  • Category: security
  • Severity: high
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about a server setting, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: MySQL 8.4

What ends up in the file​

Everything but account passwords. An UPDATE that sets a token goes in with the token, and so does any value interpolated into SQL rather than bound.

The server rewrites one kind of secret before it writes the line: the password of CREATE USER, ALTER USER and SET PASSWORD becomes <secret>. Measured on MySQL 8.0 with log_raw off, its default; a server started with log_raw writes those passwords as well. Nothing else is rewritten, because the general query log is a debugging tool: it records what was sent.

Why that is worse than it sounds​

The result is a file that is often world-readable, usually outside whatever protects the database itself, and routinely swept into log shipping. It holds a copy of what the database was guarding.

And the credentials in it stay valid until somebody rotates them — which nobody does, because nobody rotates what they do not know leaked.

Why it is a finding rather than a preference​

It is off by default and meant to be on for minutes, while somebody is looking at something. A server that has it on is almost always one where that was forgotten. The cost is silent and grows with uptime, which is exactly the shape a person does not notice.

What it looks like​

# my.cnf: every statement written down, verbatim and unredacted.
general_log = ON

What to do about it​

# Off is the vendor default, and where a server should be between debugging sessions.
general_log = OFF

SET GLOBAL general_log = OFF takes effect immediately and without downtime. The variable is GLOBAL-only, so no individual session may set it.

What this rule cannot see​

Whether the destination is a file or a table, who can read it, and whether anything ships it elsewhere. Those are questions about the host rather than about the server's catalog, and this finding does not claim them.

The fix material this rule carries​

A finding from this rule carries a payload whose strategy is none: this rule has looked, and there is no safe standard sequence. That is a conclusion rather than an omission — a finding with no payload at all says only that nobody wrote one.

The payload is material for you or an agent to apply. SQLens writes no migration and runs no DDL. See the remediation payload for every field, the placeholder semantics, and the version rules a consumer has to follow.