From: Chris Browne <cbbrowne@acm.org>
Subject: Re: password strength verification
Date: Thu, 18 Dec 2008 13:04:28 -0500
Organization: cbbrowne Computing Inc
Lines: 30
Message-ID: <8763lhcqc3.fsf@dba2.int.libertyrms.com>
References: <126094.75269.qm@web35904.mail.mud.yahoo.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
User-Agent: Gnus/5.110006 (No Gnus v0.6) XEmacs/21.4.21 (linux)
Cancel-Lock: sha1:MkbP6Ljc39CHB34VJwhcesX1bNs=
To: pgsql-admin@postgresql.org

rexmabry@yahoo.com (Rex Mabry) writes:
>  If a company requires a password to be a combination of letters,
>  numbers and special characters. Oracle has a profile setting with a
>  password verify function that can be used to specify a function
>  that can do this.  Does postgres have a setting or function to
>  verify and enforce a password policy?  I am very familiar with
>  pg_hba.conf, but I am looking specifically at passwords.

If I were wanting to enforce this, I think I'd do it via PAM.

That is, I would configure PostgreSQL to use the PAM service (METHOD =
"pam", OPTION = name of PAM service), and configure these requirements
into the PAM service.

There are several alternative indirections available:
 - LDAP authentication would allow you to manage password policy
   in the LDAP instance, quite independent of PostgreSQL.

 - krb5 indicates use of Kerberos, which would, again, keep passwords
   out of PostgreSQL altogether.

With all of these options being readily available for using
centralized authorization management and policy, I don't see any
particular value in duplicating low level security policy mechanisms
in PostgreSQL.
-- 
output = ("cbbrowne" "@" "cbbrowne.com")
http://linuxdatabases.info/info/postgresql.html
"Well, I wish  you'd just  tell me rather   than trying to engage   my
enthusiasm, because I haven't got one." -- Marvin the Paranoid Android