From: Ron <ronljohnsonjr@gmail.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: User to get locked after three wrong login attempts.
Date: Wed, 5 Sep 2018 17:40:06 -0500
Message-ID: <69ff0db1-be26-5746-7b51-867f07c74d36@gmail.com> (raw)
In-Reply-To: <87r2i760kp.fsf@gmail.com>
References: <CAHnVB4C9tSJkD4Ysd645HJmJjWzNYKJgUumE74YY8FRjUFJE4g@mail.gmail.com>
<30655.1536069964@sss.pgh.pa.us>
<20180905174832.GO4184@tamriel.snowman.net>
<87va7j61g2.fsf@gmail.com>
<CAFwQ8rerOUEptWfbtrVusBTMqsEcTqDbnN6Q+O+o-49mmTUPqw@mail.gmail.com>
<87r2i760kp.fsf@gmail.com>
On 09/05/2018 05:28 PM, Tim Cross wrote:
[snip]
> Unfortunately, that is a reflection of the poor standard of most
> auditors. They are rarely technical people and just follow a rule
> book. Most of their rules are outdated and many are wrong. For example,
> many still require 'complex' passwords consisting of mixed case,
> punctuation/special characters etc. This is despite the fact the person
> who originally proposed such a scheme has actually come out and
> apologised and said he had it wrong (plus this 'standard' was removed
> from NIST standards over 2 years ago) and ignores the changes in
> technologies which has changed the threat (i.e. rainbow tables etc now
> mean length is far more important than complexity).
>
> The 'trick' with auditors is to only answer what they ask and answer in
> such a way that what you say is true, but perhaps open to favourable
> interpretation. e.g.
>
> Auditor: do your accounts get locked after X failed login attempts
> Answer: We use Active directory for our Windows domain, which has the
> failed login policy enabled.
> Auditor: Ah yes, I know about that - good, I will mark you as
> compliant.
>
> rather than
>
> Answer: Well sort of. We have AD for our windows accounts which has the
> failed login policy enabled, but some of our systems, like Postgres,
> don't use that service.
> Auditor: So do you get locked if you try to login to postgres and fail X
> times
> Answer: No
> Auditor: Oh dear, I will have to mark you as non-compliant.
Sadly, our auditors are a bit cleverer. "Send us a screenshot showing that
Server X gets locked out after three failed tries." Naturally, Server X runs
Postgres.
--
Angular momentum makes the world go 'round.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: ronljohnsonjr@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: User to get locked after three wrong login attempts.
In-Reply-To: <69ff0db1-be26-5746-7b51-867f07c74d36@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox