Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fxbuz-0006Qk-56 for pgsql-admin@arkaria.postgresql.org; Wed, 05 Sep 2018 17:48:41 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1fxbuv-0005AG-Iu for pgsql-admin@arkaria.postgresql.org; Wed, 05 Sep 2018 17:48:37 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fxbuv-0005A1-B5 for pgsql-admin@lists.postgresql.org; Wed, 05 Sep 2018 17:48:37 +0000 Received: from tamriel.snowman.net ([96.255.250.162]) by magus.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1fxbus-0002Qn-5s for pgsql-admin@postgresql.org; Wed, 05 Sep 2018 17:48:36 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 5B3855F79C; Wed, 5 Sep 2018 13:48:32 -0400 (EDT) Date: Wed, 5 Sep 2018 13:48:32 -0400 From: Stephen Frost To: Tom Lane Cc: Praneel Devisetty , pgsql-admin@postgresql.org Subject: Re: User to get locked after three wrong login attempts. Message-ID: <20180905174832.GO4184@tamriel.snowman.net> References: <30655.1536069964@sss.pgh.pa.us> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="AA9g+nFNFPYNJKiL" Content-Disposition: inline In-Reply-To: <30655.1536069964@sss.pgh.pa.us> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --AA9g+nFNFPYNJKiL Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Tom Lane (tgl@sss.pgh.pa.us) wrote: > Praneel Devisetty writes: > > We have a requirement , where we require a user to get locked after thr= ee > > wrong login attempts. >=20 > The usual recommendation is to configure Postgres to use PAM > authentication; then you can set up any weird requirements like > this one in the PAM configuration. Unfortunately, it's a pain to set up PAM and there's a lot of things in the PAM stack which can't be used because PostgreSQL doesn't run as root. We should really have a better solution to this pretty commonly asked for capability; I'm hoping to find time soon to hack on that. Thanks! Stephen --AA9g+nFNFPYNJKiL Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJbkBbvAAoJEO1sijiDR2RV9vwQAKpB3CUC/1UAcam30fvpcXeF A66otFfv8J7VEaDd7qFYZvO/eNup3y6JF8VAo1eUU1D+6cwRNpN/6RMG5c0Y3AGA qHV0NSHFf3aIxckNYbqVLgBNh2Xj8T9clZlL4Myq9tXttSsGFXOrrKpKm49SxwMt 94rM58yHXvxqk42lVgrsycR00FMNeyYMdHlblNUAoGLcTeoPKpgVd6o3LZNP9XLE LFacBBMrf8w8ilxhOfiIEYXsbLpegKjS3tfJrbxw4cokFVLwNj5kLlYp21/idgDR hS04Avlfm2CqWpeYtd9LC9i+KEizZe/ZmNJ7ZD4h08nvuSOQ1pKv4aeaS9m9eccX 5Jz2W0JcnXNu9dQkKm9VOGqi7SNJyNVRny/9OHCAPCKUcQyx7A7TVySmVVwJHGiF IXjjmWd2O1HU0j2wJToKfrbeq6oYrVYt8i2FQ0jO7Xqt6I69gOD087gpWf8pJ64S CZe8tjpnijNj3z9SHFp31sq63N2rwEovtovFc7qtaUlQcjfMvTQGO6m0f2jbjjK8 OYNPCDz+YPHcuxQ+uDEFKqOi6sbG9lBSFtE3V7LyEgn+y2I9czHkqW9uv1mwOvp7 hH1l0hkhmhHlA5UDtxcVh0Rwo2mlSd7LZlZzzge2AeWb7irdY8l1DKAsFOJ2BNlc VQ+0Bgmv3kJJUCZPzTF2 =Z45z -----END PGP SIGNATURE----- --AA9g+nFNFPYNJKiL--