starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-26 01:45:54 +03:00

[GH-ISSUE #4336] RFE: Redact secret keys in logfiles #2790

New issue

Open

opened 2026-02-26 07:36:47 +03:00 by kerem · 2 comments

kerem commented

2026-02-26 07:36:47 +03:00

Owner

Originally created by @ppfeister on GitHub (Feb 1, 2025).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4336

NPM allows for automatic cert renewal with LetsEncrypt, given proper credentials. It's made clear that these credentials will be stored in plaintext (and there is good reason for this). However, there isn't any real reason in my mind that the keys can't be redacted from the logfiles. In many setups, these logs are ingested by other monitoring solutions, so redaction would reduce exposure by quite a bit.

For instance, the Route53 access key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY could instead appear in the logs as shown below. Enough information to figure out which key it is, but not enough information for another party to derive the key itself (or key length). This change should have no impact on the renewal functionality of NPM itself.

proxy  | [1/29/2025] [9:00:00 PM] [Global   ] › ⬤  debug     CMD: [ -f '/etc/letsencrypt/credentials/credentials-7' ] || { mkdir -p /etc/letsencrypt/credentials 2> /dev/null; echo '[default]
proxy  | aws_access_key_id=AKI***PLE
proxy  | aws_secret_access_key=wJa***KEY' > '/etc/letsencrypt/credentials/credentials-7' && chmod 600 '/etc/letsencrypt/credentials/credentials-7'; }

Originally created by @ppfeister on GitHub (Feb 1, 2025). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4336  NPM allows for automatic cert renewal with LetsEncrypt, given proper credentials. It's made clear that these credentials will be stored in plaintext (and there is good reason for this). However, there isn't any real reason in my mind that the keys can't be redacted from the logfiles. In many setups, these logs are ingested by other monitoring solutions, so redaction would reduce exposure by quite a bit. For instance, the Route53 access key `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY` could instead appear in the logs as shown below. Enough information to figure out which key it is, but not enough information for another party to derive the key itself (or key length). This change should have no impact on the renewal functionality of NPM itself. ``` proxy | [1/29/2025] [9:00:00 PM] [Global ] › ⬤ debug CMD: [ -f '/etc/letsencrypt/credentials/credentials-7' ] || { mkdir -p /etc/letsencrypt/credentials 2> /dev/null; echo '[default] proxy | aws_access_key_id=AKI***PLE proxy | aws_secret_access_key=wJa***KEY' > '/etc/letsencrypt/credentials/credentials-7' && chmod 600 '/etc/letsencrypt/credentials/credentials-7'; } ```

kerem added the

enhancement

label

2026-02-26 07:36:47 +03:00

kerem commented

2026-02-26 07:36:48 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Aug 24, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Aug 24, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 07:36:48 +03:00

Author

Owner

@ppfeister commented on GitHub (Aug 24, 2025):

Still desired.

@ppfeister commented on GitHub (Aug 24, 2025): Still desired.

kerem referenced this issue

2026-02-26 08:31:20 +03:00

[PR #2790] [CLOSED] Adding Bunny CDN certbot plugin and Mysql SSL support #3624

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#2790

No description provided.

Rows
Columns