From: Tom Lane <tgl@sss.pgh.pa.us>
To: Magnus Hagander <magnus@hagander.net>
cc: Laurenz Albe <laurenz.albe@cybertec.at>, Daulat <daulat.dba@gmail.com>,
        pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Re: Password complexities in Postgres v14.6
In-reply-to: 
 <CABUevExd8w-o1_SAbc3-1kRKbGFJP2S_86jvVFpqbWr_VPfVYA@mail.gmail.com>
References: 
 <CALfOM6LjVBhpHg+6nVe6reOBYdPJZXvXhkp+dqquG9cVBsGPmQ@mail.gmail.com>
 <2192ed923b577ce4a8a90479c7ed1c97f7a6523d.camel@cybertec.at>
 <3675887.1671203806@sss.pgh.pa.us>
 <CABUevExd8w-o1_SAbc3-1kRKbGFJP2S_86jvVFpqbWr_VPfVYA@mail.gmail.com>
Comments: In-reply-to Magnus Hagander <magnus@hagander.net>
	message dated "Fri, 16 Dec 2022 16:41:39 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3682759.1671207449.1@sss.pgh.pa.us>
Date: Fri, 16 Dec 2022 11:17:29 -0500
Message-ID: <3682760.1671207449@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3682760.1671207449%40sss.pgh.pa.us>
Precedence: bulk

Magnus Hagander <magnus@hagander.net> writes:
> On Fri, Dec 16, 2022 at 4:16 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> You can fairly easily enforce password age limits in PG using the
>> ALTER USER ... VALID UNTIL option.

> The part about requiring repeated password changes is considered actively
> harmful these days, so it's definitely obsolete. (Note that this is
> different from the postgres setting for VALID UNTIL which is not about the
> password being valid until, it's about the entire user being valid until
> the specified time).

No, VALID UNTIL only applies to the password; you can log in via
non-password-based auth mechanisms regardless of that.

(I agree that forced password rotations are also an obsolete security
practice, but figured that one bit of push-back at a time was enough.)

> And of course in either case a proper solution like using gssapi/kerberos
> is the better choice.

Yeah, migrating to something like that would be best practice.

			regards, tom lane