pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Bruce Momjian <bruce@momjian.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Vipin Madhusoodanan <vipin.madhusoodanan@gmail.com>
Cc: Vijaykumar Jain <vijaykumarjain.github@gmail.com>
Cc: pgsql-admin@lists.postgresql.org, Holger Jakobs <holger@jakobs.com>
Subject: Re: Query on User account password change details
Date: Sat, 8 May 2021 09:37:42 -0400
Message-ID: <20210508133742.GA27049@momjian.us> (raw)
In-Reply-To: <6bc4ea2d4055691bc3e309aa1488721da9c8c2c0.camel@cybertec.at>
References: <CAPOO3u4cxoCmJsXJaMHCLavecb-Bc77=qh=dfQN+bbYJ6gneWA@mail.gmail.com>
	<90B6B3A1-BB95-4D69-99EF-D86C0A859431@jakobs.com>
	<CAM+6J95bx6yUwv-rw4Cxft68YkxiQHKWDOW0LLNbymbt6538Kw@mail.gmail.com>
	<CAPOO3u7Y=_suBOaJuZZdB=rMYRtekQZO8=ZsEatDoR+cqZb3DQ@mail.gmail.com>
	<CAPOO3u4-McoLHk06fR6h6EhYMjarK7aNX-tLXLyq927hG-SByQ@mail.gmail.com>
	<6bc4ea2d4055691bc3e309aa1488721da9c8c2c0.camel@cybertec.at>

On Sat, May  8, 2021 at 05:44:52AM +0200, Laurenz Albe wrote:
> On Fri, 2021-05-07 at 15:47 -0500, Vipin Madhusoodanan wrote:
> > Can someone help with suggestions or ideas for a workaround to achieve this? 
> > 
> > > > > > Please advise on the possibilities to retrieve “last password change date”  for a PostgreSQL user account.
> > > > > >  We have an audit requirement to identify the password change details for local PostgreSQL user accounts.
> 
> You cannot do that unless you want to modify PostgreSQL.
> 
> For requirements like this, the recommendation is *not* to use passwords
> in the database for authentication.  Use one of the other authentication
> methods that uses an external authority.
> 
> Identity management systems specialize in that kind of thing, and you may
> be able to get that information from there.

Here is a blog entry about using cerrificate authenticaiton and rotating them:

	https://momjian.us/main/blogs/pgblog/2020.html#July_17_2020

The certificates must have expiration dates.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  If only the physical world exists, free will is an illusion.






view thread (20+ messages)  latest in thread

Message-ID: <20210508133742.GA27049@momjian.us>
Permalink:  ../20210508133742.GA27049@momjian.us/
Also on:    postgresql.org/message-id/20210508133742.GA27049@momjian.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: bruce@momjian.us, laurenz.albe@cybertec.at, vipin.madhusoodanan@gmail.com, vijaykumarjain.github@gmail.com, holger@jakobs.com
  Subject: Re: Query on User account password change details
  In-Reply-To: <20210508133742.GA27049@momjian.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox