Subject: Re: Query on User account password change details
To: pgsql-admin@lists.postgresql.org
References: 
 <CAPOO3u4cxoCmJsXJaMHCLavecb-Bc77=qh=dfQN+bbYJ6gneWA@mail.gmail.com>
 <90B6B3A1-BB95-4D69-99EF-D86C0A859431@jakobs.com>
 <4e87a433-531f-d108-4ef6-0c54ba44f587@gmail.com>
 <DFC3EF54-3AA9-468A-9537-431970DE1B3A@elevated-dev.com>
 <1d0196b7-01e2-e979-e023-d684331db8ea@gmail.com>
 <20210507141005.GB10431@momjian.us>
From: Ron <ronljohnsonjr@gmail.com>
Message-ID: <8ed70776-3c35-d688-4820-4c73cbdb767a@gmail.com>
Date: Fri, 7 May 2021 09:14:21 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <20210507141005.GB10431@momjian.us>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Archived-At: 
 <https://www.postgresql.org/message-id/8ed70776-3c35-d688-4820-4c73cbdb767a%40gmail.com>
Precedence: bulk

On 5/7/21 9:10 AM, Bruce Momjian wrote:
> On Fri, May  7, 2021 at 08:55:15AM -0500, Ron wrote:
>> On 5/7/21 7:30 AM, Scott Ribe wrote:
>>>> On May 6, 2021, at 11:40 PM, Ron <ronljohnsonjr@gmail.com> wrote:
>>>>
>>>> Comments like this are indicative of someone who's never been through an external audit.
>>> While maybe true, the point stands that even the original source of the requirement has admitted it's a bad idea, and standards bodies are dropping it. So, unlike many other things we might consider pointless, with this one, you have the kind of defense that might work in an audit.
>> The problem is that Postgresql allows Really Short Passwords without
>> uttering a peep, and that's not defensible to an auditor.
>>
>> psql (12.5 (Ubuntu 12.5-1.pgdg18.04+1))
>> Type "help" for help.
>>
>> postgres=# create role foo password 'a';
>> CREATE ROLE
>> postgres=#
> Have you considered passwordcheck?
>
> 	https://www.postgresql.org/docs/13/passwordcheck.html

This might satisfy my own audit requirements!

-- 
Angular momentum makes the world go 'round.