pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed

From: Tom Lane <tgl@sss.pgh.pa.us>
To: Bruce Momjian <bruce@momjian.us>
Cc: Ron <ronljohnsonjr@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Query on User account password change details
Date: Fri, 07 May 2021 10:41:05 -0400
Message-ID: <35005.1620398465@sss.pgh.pa.us> (raw)
In-Reply-To: <20210507141005.GB10431@momjian.us>
References: <CAPOO3u4cxoCmJsXJaMHCLavecb-Bc77=qh=dfQN+bbYJ6gneWA@mail.gmail.com>
	<90B6B3A1-BB95-4D69-99EF-D86C0A859431@jakobs.com>
	<4e87a433-531f-d108-4ef6-0c54ba44f587@gmail.com>
	<DFC3EF54-3AA9-468A-9537-431970DE1B3A@elevated-dev.com>
	<1d0196b7-01e2-e979-e023-d684331db8ea@gmail.com>
	<20210507141005.GB10431@momjian.us>

Bruce Momjian <bruce@momjian.us> writes:
> On Fri, May  7, 2021 at 08:55:15AM -0500, Ron wrote:
>> The problem is that Postgresql allows Really Short Passwords without
>> uttering a peep, and that's not defensible to an auditor.

> Have you considered passwordcheck?
> 	https://www.postgresql.org/docs/13/passwordcheck.html

BTW, this is a perfect example of why obsolete auditing rules actually
are a net negative to security.  The only way passwordcheck can enforce
anything about the password's strength is if the server gets to see the
cleartext password.  In these days of SCRAM, requiring that is in
itself bad practice: the cleartext password ought never leave the
client's machine.

			regards, tom lane

view thread (20+ messages)  latest in thread

Message-ID: <35005.1620398465@sss.pgh.pa.us>
Permalink:  ../35005.1620398465@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/35005.1620398465@sss.pgh.pa.us

copy link · copy postgr.es

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: tgl@sss.pgh.pa.us, bruce@momjian.us, ronljohnsonjr@gmail.com, pgsql-admin@lists.postgresql.org
  Subject: Re: Query on User account password change details
  In-Reply-To: <35005.1620398465@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox