From: Tom Lane <tgl@sss.pgh.pa.us>
To: Magnus Hagander <magnus@hagander.net>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Daulat <daulat.dba@gmail.com>
Cc: pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: Password complexities in Postgres v14.6
Date: Fri, 16 Dec 2022 11:17:29 -0500
Message-ID: <3682760.1671207449@sss.pgh.pa.us> (raw)
In-Reply-To: <CABUevExd8w-o1_SAbc3-1kRKbGFJP2S_86jvVFpqbWr_VPfVYA@mail.gmail.com>
References: <CALfOM6LjVBhpHg+6nVe6reOBYdPJZXvXhkp+dqquG9cVBsGPmQ@mail.gmail.com>
<2192ed923b577ce4a8a90479c7ed1c97f7a6523d.camel@cybertec.at>
<3675887.1671203806@sss.pgh.pa.us>
<CABUevExd8w-o1_SAbc3-1kRKbGFJP2S_86jvVFpqbWr_VPfVYA@mail.gmail.com>
Magnus Hagander <magnus@hagander.net> writes:
> On Fri, Dec 16, 2022 at 4:16 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> You can fairly easily enforce password age limits in PG using the
>> ALTER USER ... VALID UNTIL option.
> The part about requiring repeated password changes is considered actively
> harmful these days, so it's definitely obsolete. (Note that this is
> different from the postgres setting for VALID UNTIL which is not about the
> password being valid until, it's about the entire user being valid until
> the specified time).
No, VALID UNTIL only applies to the password; you can log in via
non-password-based auth mechanisms regardless of that.
(I agree that forced password rotations are also an obsolete security
practice, but figured that one bit of push-back at a time was enough.)
> And of course in either case a proper solution like using gssapi/kerberos
> is the better choice.
Yeah, migrating to something like that would be best practice.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, magnus@hagander.net, laurenz.albe@cybertec.at, daulat.dba@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Password complexities in Postgres v14.6
In-Reply-To: <3682760.1671207449@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox