pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedLock after several failed login attempts
5+ messages / 5 participants
[nested] [flat]
* Lock after several failed login attempts
@ 2021-03-09 18:12 postbox giridhar <giridharpostbox@gmail.com>
0 siblings, 2 replies; 5+ messages in thread
From: postbox giridhar @ 2021-03-09 18:12 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
Hi Team,
Is it possible to lock a database user after several failed login attempts.
Please suggest me.
Regards
Giridhar
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: Lock after several failed login attempts
@ 2021-03-09 18:20 Tom Lane <tgl@sss.pgh.pa.us>
parent: postbox giridhar <giridharpostbox@gmail.com>
1 sibling, 1 reply; 5+ messages in thread
From: Tom Lane @ 2021-03-09 18:20 UTC (permalink / raw)
To: postbox giridhar <giridharpostbox@gmail.com>; +Cc: pgsql-admin@lists.postgresql.org
postbox giridhar <giridharpostbox@gmail.com> writes:
> Is it possible to lock a database user after several failed login attempts.
No such thing is built into PG. You can use external authentication
solutions, such as PAM, for this and related requirements.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: Lock after several failed login attempts
@ 2021-03-09 18:45 Stephen Frost <sfrost@snowman.net>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 5+ messages in thread
From: Stephen Frost @ 2021-03-09 18:45 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: postbox giridhar <giridharpostbox@gmail.com>; pgsql-admin@lists.postgresql.org
Greetings,
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> postbox giridhar <giridharpostbox@gmail.com> writes:
> > Is it possible to lock a database user after several failed login attempts.
>
> No such thing is built into PG. You can use external authentication
> solutions, such as PAM, for this and related requirements.
Attempting to arrange for this to happen with the typcial PAM modules is
a disaster since PG's authentication code doesn't run as root and the
PAM modules expect to, not to mention that the account then has to exist
in the PAM world (as an actual unix user) and be authenticated using PAM
methods (meaning you can't use PG's SCRAM).
This capability, among many others in this area, are missing in PG today
and we should accept that and hopefully someone will then work on
implementing them. Suggesting to use PAM really isn't helpful.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: Lock after several failed login attempts
@ 2021-03-09 20:45 Holger Jakobs <holger@jakobs.com>
parent: Stephen Frost <sfrost@snowman.net>
0 siblings, 0 replies; 5+ messages in thread
From: Holger Jakobs @ 2021-03-09 20:45 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
Am 09.03.21 um 19:45 schrieb Stephen Frost:
> Greetings,
>
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> postbox giridhar <giridharpostbox@gmail.com> writes:
>>> Is it possible to lock a database user after several failed login attempts.
>> No such thing is built into PG. You can use external authentication
>> solutions, such as PAM, for this and related requirements.
> Attempting to arrange for this to happen with the typcial PAM modules is
> a disaster since PG's authentication code doesn't run as root and the
> PAM modules expect to, not to mention that the account then has to exist
> in the PAM world (as an actual unix user) and be authenticated using PAM
> methods (meaning you can't use PG's SCRAM).
>
> This capability, among many others in this area, are missing in PG today
> and we should accept that and hopefully someone will then work on
> implementing them. Suggesting to use PAM really isn't helpful.
>
> Thanks,
>
> Stephen
Hello,
Maybe this can help:
fail2ban can also be used for failed login attempts to PostgreSQL
https://gist.github.com/rc9000/fd1be13b5c8820f63d982d0bf8154db1
--
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012
Attachments:
OpenPGP_signature (application/pgp-signature, 202B) download
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: Lock after several failed login attempts
@ 2021-03-10 08:14 Laurenz Albe <laurenz.albe@cybertec.at>
parent: postbox giridhar <giridharpostbox@gmail.com>
1 sibling, 0 replies; 5+ messages in thread
From: Laurenz Albe @ 2021-03-10 08:14 UTC (permalink / raw)
To: postbox giridhar <giridharpostbox@gmail.com>; pgsql-admin@lists.postgresql.org
On Tue, 2021-03-09 at 23:42 +0530, postbox giridhar wrote:
> Is it possible to lock a database user after several failed login attempts.
> Please suggest me.
The only thing built into PostgreSQL that does something in that direction
is auth_delay (https://www.postgresql.org/docs/current/auth-delay.html).
It introduces a pause after each failed login attempt, which makes
brute force attacks much harder.
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2021-03-10 08:14 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-03-09 18:12 Lock after several failed login attempts postbox giridhar <giridharpostbox@gmail.com>
2021-03-09 18:20 ` Tom Lane <tgl@sss.pgh.pa.us>
2021-03-09 18:45 ` Stephen Frost <sfrost@snowman.net>
2021-03-09 20:45 ` Holger Jakobs <holger@jakobs.com>
2021-03-10 08:14 ` Laurenz Albe <laurenz.albe@cybertec.at>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox