pdscan

You can install pdscan using several methods depending on your environment:

Prebuilt Binaries

Download the latest version for your platform from the GitHub releases page:

• Linux: x86_64 or arm64 tar.gz
• Mac: x86_64 or arm64 darwin tar.gz
• Windows: x86_64 zip

Go

go install github.com/ankane/pdscan@latest

Homebrew

brew install ankane/brew/pdscan

Docker

Pull the image:

docker pull ankane/pdscan

Run it by passing a connection URI:

docker run -ti ankane/pdscan <connection-uri>

Connect to Postgres using the postgres:// protocol.

Security Note: Always ensure your connection is secure when connecting over a network. Use SSH, a VPN, or append ?sslmode=verify-full to the URI. If you need to explicitly disable SSL, append ?sslmode=disable.

Optimization: For better sampling performance, enable the tsm_system_rows extension in your Postgres database:

CREATE EXTENSION tsm_system_rows;

pdscan postgres://user:pass@host:5432/dbname?sslmode=disable

When running pdscan inside Docker, you may need to connect to services on the host machine or mount local files.

Connecting to host databases: Use host.docker.internal as the hostname.

• Linux: Requires the --add-host flag: docker run -ti --add-host=host.docker.internal:host-gateway pdscan "postgres://user@host.docker.internal:5432/dbname?sslmode=disable"
• Mac/Windows: docker run -ti pdscan "postgres://user@host.docker.internal:5432/dbname?sslmode=disable"

Scanning host files: Mount the local directory as a volume: docker run -ti -v /path/to/files:/data pdscan file:///data

Use the file:// prefix to scan files or entire directories.

• File: file://path/to/file.txt
• Directory: file://path/to/directory
• Absolute path: file:///absolute/path/to/file.txt
• Home directory (Mac/Linux): file://$HOME/file.txt

pdscan file:///absolute/path/to/file.txt

To scan Elasticsearch or OpenSearch, use the appropriate protocol prefix in your connection URI. You can specify individual indices or use wildcards.

Elasticsearch:

• HTTP: elasticsearch+http://user:pass@host:9200
• HTTPS: elasticsearch+https://user:pass@host:9200
• Specific indices: elasticsearch+http://user:pass@host:9200/index1,index2
• Wildcards: "elasticsearch+http://user:pass@host:9200/index*"

OpenSearch:

• HTTP: opensearch+http://user:pass@host:9200
• HTTPS: opensearch+https://user:pass@host:9200
• Specific indices: opensearch+http://user:pass@host:9200/index1,index2
• Wildcards: "opensearch+http://user:pass@host:9200/index*"

pdscan elasticsearch+http://user:pass@host:9200/index1,index2

Scan files in S3 using the s3:// prefix.

• Single file: s3://bucket/path/to/file.txt (Requires s3:GetObject permission)
• Directory/Prefix: s3://bucket/path/to/directory/ (Requires s3:ListBucket and s3:GetObject permissions)

pdscan s3://bucket/path/to/directory/

pdscan supports several other data stores via URI-based connection strings:

• MariaDB: mariadb://user:pass@host:3306/dbname
• MongoDB: mongodb://user:pass@host:27017/dbname
• MySQL: mysql://user:pass@host:3306/dbname
• Redis: redis://user:pass@host:6379/db
• SQLite: sqlite://path/to/dbname.sqlite3 (Note: Not available with prebuilt binaries)
• SQL Server: "sqlserver://user:pass@host:1433?database=dbname"

pdscan mysql://user:pass@host:3306/dbname

Use these flags to customize the scan behavior:

The pdscan command scans your data stores for unencrypted personal data (PII). You must provide a connection URI as the primary argument.

Usage:

pdscan [connection-uri] [flags]

If no connection URI is provided, the help menu will be displayed.