Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lJhME-0006PB-9Q for pgsql-admin@arkaria.postgresql.org; Tue, 09 Mar 2021 18:45:26 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lJhMC-0007FP-OX for pgsql-admin@arkaria.postgresql.org; Tue, 09 Mar 2021 18:45:24 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lJhMC-0007FI-Gl for pgsql-admin@lists.postgresql.org; Tue, 09 Mar 2021 18:45:24 +0000 Received: from tamriel.snowman.net ([2001:470:e38f::11]) by magus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1lJhLz-00054R-SG for pgsql-admin@lists.postgresql.org; Tue, 09 Mar 2021 18:45:24 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 061B05F799; Tue, 9 Mar 2021 13:45:07 -0500 (EST) Date: Tue, 9 Mar 2021 13:45:07 -0500 From: Stephen Frost To: Tom Lane Cc: postbox giridhar , pgsql-admin@lists.postgresql.org Subject: Re: Lock after several failed login attempts Message-ID: <20210309184507.GP20766@tamriel.snowman.net> References: <2037257.1615314027@sss.pgh.pa.us> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="WmbeDIqooxy+l+0t" Content-Disposition: inline In-Reply-To: <2037257.1615314027@sss.pgh.pa.us> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --WmbeDIqooxy+l+0t Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Tom Lane (tgl@sss.pgh.pa.us) wrote: > postbox giridhar writes: > > Is it possible to lock a database user after several failed login attem= pts. >=20 > No such thing is built into PG. You can use external authentication > solutions, such as PAM, for this and related requirements. Attempting to arrange for this to happen with the typcial PAM modules is a disaster since PG's authentication code doesn't run as root and the PAM modules expect to, not to mention that the account then has to exist in the PAM world (as an actual unix user) and be authenticated using PAM methods (meaning you can't use PG's SCRAM). This capability, among many others in this area, are missing in PG today and we should accept that and hopefully someone will then work on implementing them. Suggesting to use PAM really isn't helpful. Thanks, Stephen --WmbeDIqooxy+l+0t Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJgR8IzAAoJEO1sijiDR2RVTfoP/1j84fS2zpLSRhZ4jyQlRBo/ sz7v1pjfMXwvbuUddcqUnleHxPoSxoFDOLXdLyIQGQ7a1m7ceqGkqYL3+1dOYx9b skVWeBgvFuSfT3I03YC7ohWnLvhiUkkT04nd6rXN/PcfGTB58TEIfZ+yzvszef6T scf4PIdSp8WFijRhQE3XFKyy7Xlx2utl1XntW3/nlejf8scjNMqVetQAfnzujqQk 1Zxlu+qwU3xlCLruKhAM7pHIxmegObc6I/SsxfATUZwVg1oiZPXSpiU4t2BJQngV FJReIY3snyEse3V6y2S60OqB3bUlbXclgMcC8hJ7v5rih52FXjH05C9I354r8Rvx jFpfvE13rfsOg/82lBdzm527P64E07m6vQJaEcHAMudyC65NyWMy7NACKNOB6Cqg cGQ3FGth/b4vz1VVOCUgbAmM10dKKSf+lj+yAmvdHCqoVFHr16g6+CEUaSzq6Jtr jBbqcyg7il/RaDb3k5xn/FQANwa921bB0cRtav4+O7xP6byUitqLQa7rYL3beNsd iKjeAtqUICD2Q/aEo/pvQNrFOgpabHdOqjxfhL8AuEEi8z+WQCNLywvYa0nBfpqC fRrtw8KyphQRzMgD1QnxQIP/Qv26Q1Jo/f5uALbLXexpFEB9F54srMuCsmh3b0Cd uzc5bnMztKAD8FuD/7YW =TDFh -----END PGP SIGNATURE----- --WmbeDIqooxy+l+0t--