Date: Mon, 16 Dec 2024 12:34:31 +0100
From: "Peter J. Holzer" <hjp-pgsql@hjp.at>
To: pgsql-general@lists.postgresql.org
Subject: Re: Credcheck- credcheck.max_auth_failure
Message-ID: <20241216113431.v5rnxexalfj6eorv@hjp.at>
Mail-Followup-To: pgsql-general@lists.postgresql.org
References: <CAFsaSDgSPjLOmk51fZt_zYPEUnFOCQ+92g_g2OSMjNbMa4h2xg@mail.gmail.com>
 <CAKAnmmLBf33oSKxxANDztHR455BhEdO=AROGvXZa1crh7VchHg@mail.gmail.com>
 <CANzqJaDJ0_Aiih6X6AMfkRaWATFrHJMw_21oS-7im8JdN9SgrQ@mail.gmail.com>
 <20241213202348.jtchbb2lezbx2re6@hjp.at>
 <CAFsaSDgsJB9WpZSxspQ0CJAkT4OjGzdh+hLqnf=hinp-ywDU6g@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="j6sutcw7j4z2vjbl"
Content-Disposition: inline
In-Reply-To: <CAFsaSDgsJB9WpZSxspQ0CJAkT4OjGzdh+hLqnf=hinp-ywDU6g@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/20241216113431.v5rnxexalfj6eorv%40hjp.at>
Precedence: bulk


--j6sutcw7j4z2vjbl
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 2024-12-16 18:32:34 +0800, =E5=BC=B5=E5=AE=B8=E7=91=8B wrote:
> We have both regular accounts and system accounts. For regular accounts, =
we
> still require password complexity and the lockout functionality after mul=
tiple
> failed login attempts. However, for system accounts, due to information
> security regulations, password complexity is also required. The issue is =
that
> system accounts are used for system integration, and if the account gets
> locked, it may affect system services, which could lead to problems. To p=
revent
> this, we would like to exclude system accounts from being affected by the
> credcheck.max_auth_failure parameter.

Just in case it wasn't clear: My recommendation is to NOT use the
credcheck.max_auth_failure parameter for ANY account. It just causes
problems and doesn't really help. If you can't trust your users to
chooses sufficiently strong passwords, use a second factor. Or maybe
replace passwords with some other method (public keys, FIDO, ...)
altogether (in fact, I'd do that for system accounts).

        hp

--=20
   _  | Peter J. Holzer    | Story must make more sense than reality.
|_|_) |                    |
| |   | hjp@hjp.at         |    -- Charles Stross, "Creative writing
__/   | http://www.hjp.at/ |       challenge!"

--j6sutcw7j4z2vjbl
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEETtJbRjyPwVTYGJ5k8g5IURL+KF0FAmdgEEEACgkQ8g5IURL+
KF3rwQ//TOr58+1RjKo486MsmFR/ESt6ivJAMaMlpAPct/q7cCu0FHPxBiaceLPU
VpAo0kB3V+ECev1u1lXCRgMxDsKvPJRiRl/A0FVtCL7W6gFrY9cTlLD8L9DLdT99
kzBMDgobAVhmTODO5bHdSa+gTE6ODi3nOcyr8hEQROiPkINP4Rl26NE5KcLIviTV
0mlft7Yx6gDqSfyFxwYudU/rW7IkVe7xQdR25RRN3hGmfawUMxGm4nK7if6Ny3iJ
s4nkVvEzCG35C1+FoNEDuODnWTEuzWH1RsFXo01nbbp0H6dCVKSuQWiWwb44INGg
hMZdDINEBK88JmQ231X+dZN3Ip9iPXOaeh7Z6lTKtZadG/xm/NRkEuKyBjnWWuz8
MMyaxnHSaMSviKELnwI1k6xR06tM2R6ers90ctz4y2qXiBQiCl9nokj1KExTTdQZ
nEMG4/W7xpo6Pcsr4XnFgWK6tU1i4DRGo9kjn3FZuCWkIHaFHQTtPzhdQNH9R/00
Ww+VxK9pHeOtDG+rIcVw9Dv21OvAFeNngOLiOBhTZHU1CLlCUduJY7wpb0QhuLXl
sj1AQHAHrWS1t53M5bqosEZJswrn78/QhBLOSFLIg0rS60hAtl4rIGsjiiRc0WGr
WAmqek7i+G/EDiyhReIp/e1gtfZOZnwJ5j9138NjuJBvI4bxya8=
=zwdh
-----END PGP SIGNATURE-----

--j6sutcw7j4z2vjbl--