Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1sKUiN-00AXz7-Cn for pgsql-admin@arkaria.postgresql.org; Fri, 21 Jun 2024 03:13:27 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1sKUiL-007Jia-Pl for pgsql-admin@arkaria.postgresql.org; Fri, 21 Jun 2024 03:13:26 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1sKUiL-007JiS-CO for pgsql-admin@lists.postgresql.org; Fri, 21 Jun 2024 03:13:25 +0000 Received: from qs51p00im-qukt01072502.me.com ([17.57.155.15]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1sKUiJ-002l1x-2R for pgsql-admin@lists.postgresql.org; Fri, 21 Jun 2024 03:13:25 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1718939601; bh=rI9Vnjs5qU4g1VAAk6euKJkgfArQKI97LMlW6XQOifc=; h=From:Message-Id:Content-Type:Mime-Version:Subject:Date:To; b=hylWWD0GIVNr2p60G+vzlDYjBtbfejoggBAW32R488bc9XpJb/ylsOUEGyoOuJF01 XXTalb6VuIqK5Ggg6pdy2Tj+B6dpADWQVmesrzhwpiS5KT4pTP9+ZvptttuXHNWxR/ 5fD5cspnCj/JMkqzDuV88yV/ySrNpOXHQ49goeS5fb5htdsOhVUwqZS4yM6s6Kktx8 4rmpIydD0mmkWoFFTSKyVYfqJ4/C4dnbjad4AZ91yabnUCBcS0B1POSNQvN04G0H2p 9eW6cZkaiKW6LDluP/tCkqKemFBpdIUdyGQTaFk83Yjh2+5S+c+eYdr1+tkMtZtV5E XL1Cgm0gYCOsQ== Received: from smtpclient.apple (qs51p00im-dlb-asmtp-mailmevip.me.com [17.57.155.28]) by qs51p00im-qukt01072502.me.com (Postfix) with ESMTPSA id 5ABAC6EC021F; Fri, 21 Jun 2024 03:13:20 +0000 (UTC) From: Rui DeSousa Message-Id: <15238DA9-4334-4838-9729-0B32CD83509F@icloud.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E74FBD05-F165-4068-BC76-7546F059691D" Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.8\)) Subject: Re: password_rollover_time like Oracle Date: Thu, 20 Jun 2024 23:13:16 -0400 In-Reply-To: Cc: Kashif Zeeshan , James Pang , pgsql-admin@lists.postgresql.org To: Bruce Momjian References: X-Mailer: Apple Mail (2.3696.120.41.1.8) X-Proofpoint-ORIG-GUID: PPggwsIMC_de2TRwbaTkZ_xjne0DqZLQ X-Proofpoint-GUID: PPggwsIMC_de2TRwbaTkZ_xjne0DqZLQ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.28.16 definitions=2024-06-20_12,2024-06-20_04,2024-05-17_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=824 phishscore=0 bulkscore=0 suspectscore=0 malwarescore=0 spamscore=0 mlxscore=0 clxscore=1011 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2308100000 definitions=main-2406210022 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --Apple-Mail=_E74FBD05-F165-4068-BC76-7546F059691D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Jun 20, 2024, at 10:46 PM, Bruce Momjian wrote: >=20 > I can see that causing problems if you want to store CURRENT_USER in = the > database, perhaps for auditing. I guess you could call it = user4_login12 > and keep incrementing the login number, but that seems cumbersome. >=20 > --=20 > Bruce Momjian > = https://momjian.us > EDB https://enterprisedb.com = >=20 > Only you can decide what is important to you. I don=E2=80=99t think it=E2=80=99s too much of an issue for auditing as = it=E2=80=99s same name with an embedded date code; however, I do think = that changing a password every other month is cumbersome busy work and = there are better ways to secure the account. The problem I=E2=80=99ve = seen with this type of solution is the application owners would commonly = forget to update password information and then the application would = stop working causing a scramble to update the credentials. Then there = is the account management itself, dropping expired users and creating = new users for the upcoming month. =20= --Apple-Mail=_E74FBD05-F165-4068-BC76-7546F059691D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Jun 20, 2024, at 10:46 PM, Bruce Momjian <bruce@momjian.us> = wrote:

I can see that causing problems if you want to store = CURRENT_USER in the
database, perhaps for auditing.  I guess you could call = it user4_login12
and keep incrementing the login number, but that seems = cumbersome.

-- 
 Bruce Momjian =  <bruce@momjian.us> =        https://momjian.us
 EDB =             &n= bsp;           &nbs= p;            = https://enterprisedb.com

 Only you can decide what is important to = you.

I = don=E2=80=99t think it=E2=80=99s too much of an issue for auditing as = it=E2=80=99s same name with an embedded date code; however, I do think = that changing a password every other month is cumbersome busy work and = there are better ways to secure the account.  The problem I=E2=80=99v= e seen with this type of solution is the application owners would = commonly forget to update password information and then the application = would stop working causing a scramble to update the credentials. =  Then there is the account management itself, dropping expired = users and creating new users for the upcoming month. =  
= --Apple-Mail=_E74FBD05-F165-4068-BC76-7546F059691D--