From rexmabry@yahoo.com Thu Dec 18 16:26:15 2008 Received: from localhost (unknown [200.46.204.183]) by mail.postgresql.org (Postfix) with ESMTP id 2D2B564FDA9 for ; Thu, 18 Dec 2008 12:26:15 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 65331-04 for ; Thu, 18 Dec 2008 12:26:12 -0400 (AST) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from web35904.mail.mud.yahoo.com (web35904.mail.mud.yahoo.com [66.163.179.188]) by mail.postgresql.org (Postfix) with SMTP id 868A764FCE9 for ; Thu, 18 Dec 2008 12:26:11 -0400 (AST) Received: (qmail 75722 invoked by uid 60001); 18 Dec 2008 16:26:10 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type:Message-ID; b=e03QY0xpR8GOapNnxcZ9ScClA5ratD1yDGqnEe3nvzvGRBttY9SJdezZEoc2wHSn7qDeLFtektD7bJ3X78IDU4CLHngkErwjJH5npXFwzuOGfgvHJECoxQLCyaykmSedEy3eybOMxlK1CJa6Azrm4EAz+R0ddSiUXZYqj5iKniw=; X-YMail-OSG: Q.YdW6wVM1kJEMUSx3BCmTbxKZRL1kFAezdrSHYB5.badzHiBnmjOcZqDhxM0Hzu4OKtron0dgvOh3aToE7toYp4K1_GKQ4LMp9qNzHZxhy9h7HmUuRLt57Brs_vPWk.0v8MEnhjzhcR6OF3DK0J8ZDBSQ-- Received: from [199.200.10.53] by web35904.mail.mud.yahoo.com via HTTP; Thu, 18 Dec 2008 08:26:10 PST X-Mailer: YahooMailWebService/0.7.260.1 Date: Thu, 18 Dec 2008 08:26:10 -0800 (PST) From: Rex Mabry Reply-To: rexmabry@yahoo.com Subject: password strength verification To: pgsql-admin@postgresql.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-54264550-1229617570=:75269" Message-ID: <126094.75269.qm@web35904.mail.mud.yahoo.com> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0.001 tagged_above=0 required=5 tests=HTML_MESSAGE=0.001 X-Spam-Level: X-Archive-Number: 200812/147 X-Sequence-Number: 30980 --0-54264550-1229617570=:75269 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Hi, If a company requires a password to be a combination of letters, numbers an= d special characters. Oracle=A0has a profile setting=A0with a password veri= fy function that can be used to specify a function that can do this.=A0 Doe= s postgres have a setting or=A0function to verify and enforce a password po= licy?=A0 I am very familiar with pg_hba.conf, but I am looking specifically= at passwords.=0A=0A=0A --0-54264550-1229617570=:75269 Content-Type: text/html; charset=us-ascii
Hi,
If a company requires a password to be a combination of letters, numbers and special characters. Oracle has a profile setting with a password verify function that can be used to specify a function that can do this.  Does postgres have a setting or function to verify and enforce a password policy?  I am very familiar with pg_hba.conf, but I am looking specifically at passwords.

--0-54264550-1229617570=:75269-- From cbbrowne@acm.org Thu Dec 18 21:16:04 2008 Received: from localhost (unknown [200.46.204.183]) by mail.postgresql.org (Postfix) with ESMTP id 82AC264FE2F for ; Thu, 18 Dec 2008 17:16:04 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 13993-10 for ; Thu, 18 Dec 2008 17:16:02 -0400 (AST) Received: from news.hub.org (news.hub.org [200.46.204.72]) by mail.postgresql.org (Postfix) with ESMTP id C080564FD29 for ; Thu, 18 Dec 2008 17:16:01 -0400 (AST) Received: from news.hub.org (news.hub.org [200.46.204.72]) by news.hub.org (8.14.1/8.14.1) with ESMTP id mBILFqcF003523 for ; Thu, 18 Dec 2008 17:15:52 -0400 (AST) (envelope-from news@news.hub.org) Received: (from news@localhost) by news.hub.org (8.14.1/8.14.1/Submit) id mBIKxl7e086815 for pgsql-admin@postgresql.org; Thu, 18 Dec 2008 16:59:47 -0400 (AST) (envelope-from news) From: Chris Browne X-Newsgroups: pgsql.admin Subject: Re: password strength verification Date: Thu, 18 Dec 2008 13:04:28 -0500 Organization: cbbrowne Computing Inc Lines: 30 Message-ID: <8763lhcqc3.fsf@dba2.int.libertyrms.com> References: <126094.75269.qm@web35904.mail.mud.yahoo.com> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Complaints-To: usenet@news.hub.org User-Agent: Gnus/5.110006 (No Gnus v0.6) XEmacs/21.4.21 (linux) Cancel-Lock: sha1:MkbP6Ljc39CHB34VJwhcesX1bNs= To: pgsql-admin@postgresql.org X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200812/149 X-Sequence-Number: 30982 rexmabry@yahoo.com (Rex Mabry) writes: > If a company requires a password to be a combination of letters, > numbers and special characters. Oracle has a profile setting with a > password verify function that can be used to specify a function > that can do this.  Does postgres have a setting or function to > verify and enforce a password policy?  I am very familiar with > pg_hba.conf, but I am looking specifically at passwords. If I were wanting to enforce this, I think I'd do it via PAM. That is, I would configure PostgreSQL to use the PAM service (METHOD = "pam", OPTION = name of PAM service), and configure these requirements into the PAM service. There are several alternative indirections available: - LDAP authentication would allow you to manage password policy in the LDAP instance, quite independent of PostgreSQL. - krb5 indicates use of Kerberos, which would, again, keep passwords out of PostgreSQL altogether. With all of these options being readily available for using centralized authorization management and policy, I don't see any particular value in duplicating low level security policy mechanisms in PostgreSQL. -- output = ("cbbrowne" "@" "cbbrowne.com") http://linuxdatabases.info/info/postgresql.html "Well, I wish you'd just tell me rather than trying to engage my enthusiasm, because I haven't got one." -- Marvin the Paranoid Android