Message-ID: <50A4B42B.1090308@2ndQuadrant.com>
Date: Thu, 15 Nov 2012 17:21:47 +0800
From: Craig Ringer <craig@2ndQuadrant.com>
Organization: 2nd Quadrant
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:16.0) Gecko/20121016 Thunderbird/16.0.1
MIME-Version: 1.0
To: Lukasz Brodziak <lukasz.brodziak@gmail.com>
CC: Frank Cavaliero <fcavalie@us.ibm.com>, pgsql-admin@postgresql.org
Subject: Re: Failed Login Attempts parameter
References: 
 <OF010D9AFE.7D96A308-ON85257AB6.00746957-85257AB6.0074746B@us.ibm.com>
	<CAGWYGjUdhSoQr3xyd0bN1JbYcsg0rgZ2kDpMOKBJCPNKpXOemg@mail.gmail.com>
In-Reply-To: 
 <CAGWYGjUdhSoQr3xyd0bN1JbYcsg0rgZ2kDpMOKBJCPNKpXOemg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 11/15/2012 04:40 PM, Lukasz Brodziak wrote:
> Hi,
>
> As far as I know there is no such parameter in PG. If you use PG as a
> database for your program you can implement the feature in the
> appplication by logging the failed logins in separate table(or the one
> holding application users and their passwords) and then disable login
> for the user if number of failures is bigger than specified value.
> Another way is to create a function in postgresql which will check
> failed login count and if the attempts go bigger than specified number
> it will run a REVOKE on the user role thus disabling login. Then admin
> will have to run GRANT for the user manually.

Another option would be to monitor syslog or the csvlog and lock the
user out by changing their password or revoking CONNECT rights if they
trip the threshold. It wouldn't be as responsive to high-rate brute
forcing attempts but your IDS should be handing those already.

-- 
 Craig Ringer                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services