Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1j6pzQ-0000u0-8F for pgsql-admin@arkaria.postgresql.org; Wed, 26 Feb 2020 06:16:12 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1j6pzP-0000sn-0x for pgsql-admin@arkaria.postgresql.org; Wed, 26 Feb 2020 06:16:11 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1j6pzO-0000sg-Nr for pgsql-admin@lists.postgresql.org; Wed, 26 Feb 2020 06:16:10 +0000 Received: from sss.pgh.pa.us ([66.207.139.130]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1j6pzK-0004Xq-MI for pgsql-admin@lists.postgresql.org; Wed, 26 Feb 2020 06:16:10 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.4/8.14.4) with ESMTP id 01Q6G2GP017320; Wed, 26 Feb 2020 01:16:02 -0500 From: Tom Lane To: Venkat jumbo cc: "pgsql-admin@lists.postgresql.org" Subject: Re: Change password In-reply-to: References: Comments: In-reply-to Venkat jumbo message dated "Wed, 26 Feb 2020 07:03:22 +0530" MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <17318.1582697762.1@sss.pgh.pa.us> Content-Transfer-Encoding: quoted-printable Date: Wed, 26 Feb 2020 01:16:02 -0500 Message-ID: <17319.1582697762@sss.pgh.pa.us> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk Venkat jumbo writes: > Can we force the user to changepassword every month /days. (passwordexpi= red > ) > Do we have this option in postgres-10 ? Postgres doesn't do that directly, though there is a provision for setting an expiration date on a password. If you want rules like that, you might look at using PAM auth and then coding the rules with PAM modules. FWIW, forced password changes are widely considered to be poor security practice these days. Before you bull ahead with this, you might read a few experts, for example https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandato= ry-password-changes https://www.sans.org/security-awareness-training/blog/time-password-expira= tion-die https://www.extremetech.com/computing/292534-microsoft-says-forced-passwor= d-resets-dont-improve-security https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html regards, tom lane