From: Tom Lane <tgl@sss.pgh.pa.us>
To: Bruce Momjian <bruce@momjian.us>
cc: Ron <ronljohnsonjr@gmail.com>, pgsql-admin@lists.postgresql.org
Subject: Re: Query on User account password change details
In-reply-to: <20210507141005.GB10431@momjian.us>
References: 
 <CAPOO3u4cxoCmJsXJaMHCLavecb-Bc77=qh=dfQN+bbYJ6gneWA@mail.gmail.com>
 <90B6B3A1-BB95-4D69-99EF-D86C0A859431@jakobs.com>
 <4e87a433-531f-d108-4ef6-0c54ba44f587@gmail.com>
 <DFC3EF54-3AA9-468A-9537-431970DE1B3A@elevated-dev.com>
 <1d0196b7-01e2-e979-e023-d684331db8ea@gmail.com>
 <20210507141005.GB10431@momjian.us>
Comments: In-reply-to Bruce Momjian <bruce@momjian.us>
	message dated "Fri, 07 May 2021 10:10:05 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <35004.1620398465.1@sss.pgh.pa.us>
Date: Fri, 07 May 2021 10:41:05 -0400
Message-ID: <35005.1620398465@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/35005.1620398465%40sss.pgh.pa.us>
Precedence: bulk

Bruce Momjian <bruce@momjian.us> writes:
> On Fri, May  7, 2021 at 08:55:15AM -0500, Ron wrote:
>> The problem is that Postgresql allows Really Short Passwords without
>> uttering a peep, and that's not defensible to an auditor.

> Have you considered passwordcheck?
> 	https://www.postgresql.org/docs/13/passwordcheck.html

BTW, this is a perfect example of why obsolete auditing rules actually
are a net negative to security.  The only way passwordcheck can enforce
anything about the password's strength is if the server gets to see the
cleartext password.  In these days of SCRAM, requiring that is in
itself bad practice: the cleartext password ought never leave the
client's machine.

			regards, tom lane