From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: postbox giridhar <giridharpostbox@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Lock after several failed login attempts
Date: Tue, 9 Mar 2021 13:45:07 -0500
Message-ID: <20210309184507.GP20766@tamriel.snowman.net> (raw)
In-Reply-To: <2037257.1615314027@sss.pgh.pa.us>
References: <CALjFJF2TdnNZ3ZbFBV8Dn4BWdiJSn_zCoWw_82wUjbnHR6VSZg@mail.gmail.com>
<2037257.1615314027@sss.pgh.pa.us>
Greetings,
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> postbox giridhar <giridharpostbox@gmail.com> writes:
> > Is it possible to lock a database user after several failed login attempts.
>
> No such thing is built into PG. You can use external authentication
> solutions, such as PAM, for this and related requirements.
Attempting to arrange for this to happen with the typcial PAM modules is
a disaster since PG's authentication code doesn't run as root and the
PAM modules expect to, not to mention that the account then has to exist
in the PAM world (as an actual unix user) and be authenticated using PAM
methods (meaning you can't use PG's SCRAM).
This capability, among many others in this area, are missing in PG today
and we should accept that and hopefully someone will then work on
implementing them. Suggesting to use PAM really isn't helpful.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, tgl@sss.pgh.pa.us, giridharpostbox@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Lock after several failed login attempts
In-Reply-To: <20210309184507.GP20766@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox