From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Lock after several failed login attempts
Date: Tue, 9 Mar 2021 21:45:32 +0100
Message-ID: <208faea3-61d8-2480-ef60-873453a9c198@jakobs.com> (raw)
In-Reply-To: <20210309184507.GP20766@tamriel.snowman.net>
References: <CALjFJF2TdnNZ3ZbFBV8Dn4BWdiJSn_zCoWw_82wUjbnHR6VSZg@mail.gmail.com>
<2037257.1615314027@sss.pgh.pa.us>
<20210309184507.GP20766@tamriel.snowman.net>
Am 09.03.21 um 19:45 schrieb Stephen Frost:
> Greetings,
>
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> postbox giridhar <giridharpostbox@gmail.com> writes:
>>> Is it possible to lock a database user after several failed login attempts.
>> No such thing is built into PG. You can use external authentication
>> solutions, such as PAM, for this and related requirements.
> Attempting to arrange for this to happen with the typcial PAM modules is
> a disaster since PG's authentication code doesn't run as root and the
> PAM modules expect to, not to mention that the account then has to exist
> in the PAM world (as an actual unix user) and be authenticated using PAM
> methods (meaning you can't use PG's SCRAM).
>
> This capability, among many others in this area, are missing in PG today
> and we should accept that and hopefully someone will then work on
> implementing them. Suggesting to use PAM really isn't helpful.
>
> Thanks,
>
> Stephen
Hello,
Maybe this can help:
fail2ban can also be used for failed login attempts to PostgreSQL
https://gist.github.com/rc9000/fd1be13b5c8820f63d982d0bf8154db1
--
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012
Attachments:
OpenPGP_signature (application/pgp-signature, 202B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: holger@jakobs.com, pgsql-admin@lists.postgresql.org
Subject: Re: Lock after several failed login attempts
In-Reply-To: <208faea3-61d8-2480-ef60-873453a9c198@jakobs.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox