From: Craig Ringer <craig@2ndQuadrant.com>
To: Lukasz Brodziak <lukasz.brodziak@gmail.com>
Cc: Frank Cavaliero <fcavalie@us.ibm.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: Failed Login Attempts parameter
Date: Thu, 15 Nov 2012 17:21:47 +0800
Message-ID: <50A4B42B.1090308@2ndQuadrant.com> (raw)
In-Reply-To: <CAGWYGjUdhSoQr3xyd0bN1JbYcsg0rgZ2kDpMOKBJCPNKpXOemg@mail.gmail.com>
References: <OF010D9AFE.7D96A308-ON85257AB6.00746957-85257AB6.0074746B@us.ibm.com>
<CAGWYGjUdhSoQr3xyd0bN1JbYcsg0rgZ2kDpMOKBJCPNKpXOemg@mail.gmail.com>
On 11/15/2012 04:40 PM, Lukasz Brodziak wrote:
> Hi,
>
> As far as I know there is no such parameter in PG. If you use PG as a
> database for your program you can implement the feature in the
> appplication by logging the failed logins in separate table(or the one
> holding application users and their passwords) and then disable login
> for the user if number of failures is bigger than specified value.
> Another way is to create a function in postgresql which will check
> failed login count and if the attempts go bigger than specified number
> it will run a REVOKE on the user role thus disabling login. Then admin
> will have to run GRANT for the user manually.
Another option would be to monitor syslog or the csvlog and lock the
user out by changing their password or revoking CONNECT rights if they
trip the threshold. It wouldn't be as responsive to high-rate brute
forcing attempts but your IDS should be handing those already.
--
Craig Ringer http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: craig@2ndQuadrant.com, lukasz.brodziak@gmail.com, fcavalie@us.ibm.com
Subject: Re: Failed Login Attempts parameter
In-Reply-To: <50A4B42B.1090308@2ndQuadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox