Subject: Re: Lock after several failed login attempts
To: pgsql-admin@lists.postgresql.org
References: 
 <CALjFJF2TdnNZ3ZbFBV8Dn4BWdiJSn_zCoWw_82wUjbnHR6VSZg@mail.gmail.com>
 <2037257.1615314027@sss.pgh.pa.us>
 <20210309184507.GP20766@tamriel.snowman.net>
From: Holger Jakobs <holger@jakobs.com>
Message-ID: <208faea3-61d8-2480-ef60-873453a9c198@jakobs.com>
Date: Tue, 9 Mar 2021 21:45:32 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.7.1
MIME-Version: 1.0
In-Reply-To: <20210309184507.GP20766@tamriel.snowman.net>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="46rsImZhsalMd6LEWucTbJ6UsKHrPRfgI"
Archived-At: 
 <https://www.postgresql.org/message-id/208faea3-61d8-2480-ef60-873453a9c198%40jakobs.com>
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--46rsImZhsalMd6LEWucTbJ6UsKHrPRfgI
Content-Type: multipart/mixed; boundary="ePlrjATzAMe9KQ5YptiivVQHxa0CEZOTk";
 protected-headers="v1"
From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Message-ID: <208faea3-61d8-2480-ef60-873453a9c198@jakobs.com>
Subject: Re: Lock after several failed login attempts
References: <CALjFJF2TdnNZ3ZbFBV8Dn4BWdiJSn_zCoWw_82wUjbnHR6VSZg@mail.gmail.com>
 <2037257.1615314027@sss.pgh.pa.us>
 <20210309184507.GP20766@tamriel.snowman.net>
In-Reply-To: <20210309184507.GP20766@tamriel.snowman.net>

--ePlrjATzAMe9KQ5YptiivVQHxa0CEZOTk
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Language: de-DE


Am 09.03.21 um 19:45 schrieb Stephen Frost:
> Greetings,
>
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> postbox giridhar <giridharpostbox@gmail.com> writes:
>>> Is it possible to lock a database user after several failed login att=
empts.
>> No such thing is built into PG.  You can use external authentication
>> solutions, such as PAM, for this and related requirements.
> Attempting to arrange for this to happen with the typcial PAM modules i=
s
> a disaster since PG's authentication code doesn't run as root and the
> PAM modules expect to, not to mention that the account then has to exis=
t
> in the PAM world (as an actual unix user) and be authenticated using PA=
M
> methods (meaning you can't use PG's SCRAM).
>
> This capability, among many others in this area, are missing in PG toda=
y
> and we should accept that and hopefully someone will then work on
> implementing them.  Suggesting to use PAM really isn't helpful.
>
> Thanks,
>
> Stephen

Hello,

Maybe this can help:

fail2ban can also be used for failed login attempts to PostgreSQL

https://gist.github.com/rc9000/fd1be13b5c8820f63d982d0bf8154db1


--=20
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012


--ePlrjATzAMe9KQ5YptiivVQHxa0CEZOTk--

--46rsImZhsalMd6LEWucTbJ6UsKHrPRfgI
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wmMEABEIACMWIQScuJCxWJK1p5BOebGKV5yTsxlhugUCYEfebAUDAAAAAAAKCRCKV5yTsxlhutho
AKC/tXloLwa6a0e92zf+nbx8lVR6yACfc2Ft6sYNTTZGPp4ENqUUuXFdYWc=
=4TUK
-----END PGP SIGNATURE-----

--46rsImZhsalMd6LEWucTbJ6UsKHrPRfgI--