Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1sLewl-00FqtL-MH for pgsql-general@arkaria.postgresql.org; Mon, 24 Jun 2024 08:21:07 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1sLewj-007UFP-GC for pgsql-general@arkaria.postgresql.org; Mon, 24 Jun 2024 08:21:05 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1sLewj-007UFH-4J for pgsql-general@lists.postgresql.org; Mon, 24 Jun 2024 08:21:05 +0000 Received: from mail-lj1-x22c.google.com ([2a00:1450:4864:20::22c]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1sLewd-003Gpx-0W for pgsql-general@lists.postgresql.org; Mon, 24 Jun 2024 08:21:04 +0000 Received: by mail-lj1-x22c.google.com with SMTP id 38308e7fff4ca-2ec595d0acbso13883671fa.1 for ; Mon, 24 Jun 2024 01:20:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybertec-at.20230601.gappssmtp.com; s=20230601; t=1719217258; x=1719822058; darn=lists.postgresql.org; h=mime-version:user-agent:content-transfer-encoding:autocrypt :references:in-reply-to:date:cc:to:from:subject:message-id:from:to :cc:subject:date:message-id:reply-to; bh=ML3GIfYU5kyObCOqbnvHwNz19sEkarU2BizeKNsZlUc=; b=FekBfQTb0bf35rESyK7jM/agnOsJlviex45q3i4lvT8mrgFHgbGsrGyJmxhKoz3M7a 7SbrcRLG/M75FlAhg+LRu0weU2slHcgHiBFastwP2DNji2+AnwiDq20UQrerqXVx6Cev l5HnUHDrwbP4859CqmKEyzQSA7iuF5YQIzBUoaGj5Hf09L1DRX+HbpShCew1n3D9gICw rz991uDoX1oYDUsEj1V9tMINccHEuAVeDvU703TlETSCCBvwt82fb+eX2IlHhXaQNIBd hH+E5A5i28PXXlMezLi/T+4ls/Nt6e75PhyS2LRmb8xxTRfGSJx1/OmqZZ83DMufzZwN qR/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1719217258; x=1719822058; h=mime-version:user-agent:content-transfer-encoding:autocrypt :references:in-reply-to:date:cc:to:from:subject:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ML3GIfYU5kyObCOqbnvHwNz19sEkarU2BizeKNsZlUc=; b=kRVLntHNVCIyl10/Xh876eboKlkXqFAydANnFhR/RQ9JO7INbQ2ReoKy02OAKtEhnx q/XpkAvRpAlrAkZXbX4MITr1W9QsNy2RxZjlofkwFXf2GB4gyEXXii7Rt7ahZVKNqdJw 152cyoT1NW+rccm1WanY1+f7xW8npDh8mq657T1f2aX/hgfG+J8+mgUWy9wEUE8a6KK2 jaVCa17+IEsa5aUZz44QZw5ysQO04EuqPuymKyHWXWxcN335gIHMnS8o5pYOTUotYI1H dPIfqNnsH7h+qI1GUFE3KycIJgKWMvv5SlLueJWpgTTFheOgAev5hjxgzvla51aL/vUt 8lfA== X-Forwarded-Encrypted: i=1; AJvYcCUdqLDD7n2x4GVnO88T2JTKq/MWqN41BKhSLNPGJvqZnVq85dN7nax1VrBw9S3yirfN3NE2YvDlNrZeIL3I4Q5oJ2hxvsr57GTDhpI1mALyNrP2 X-Gm-Message-State: AOJu0Yytcsbd6++H7ZmLGKh3fBWseIgQLcK5jCnoQhILXBdE7H6wxKH5 yUFLUFbLyNQW3XtziGnPb8t4nNL15LXd6zA4+0rSyDbStDWZwvJ5Qt+s/IPPqRc= X-Google-Smtp-Source: AGHT+IG3ffcxzLG51RDdxyPeMQDKYUg4bxEZMqLgfdxAmshBEz2tLN6OSnhSnexXHw1dJdIYfL7t5w== X-Received: by 2002:a2e:88c9:0:b0:2ec:57c7:c737 with SMTP id 38308e7fff4ca-2ec5b357a17mr29142111fa.40.1719217257646; Mon, 24 Jun 2024 01:20:57 -0700 (PDT) Received: from localhost.localdomain ([2001:871:260:b37a:5e1f:c4b9:1a7b:e1d8]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-57d3042d033sm4431977a12.39.2024.06.24.01.20.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Jun 2024 01:20:57 -0700 (PDT) Message-ID: <430fce74e2461f26e01ba5ea7ae586b44365894d.camel@cybertec.at> Subject: Re: Password complexity/history - credcheck? From: Laurenz Albe To: Martin Goodson , Christoph Moench-Tegeder Cc: Tom Lane , pgsql-general@lists.postgresql.org Date: Mon, 24 Jun 2024 10:20:56 +0200 In-Reply-To: References: <79692c1a-190c-413e-9442-a14a45c1069d@googlemail.com> <834558.1719102188@sss.pgh.pa.us> <43826fbd-2d26-467b-afcf-7fde609f8da3@googlemail.com> Autocrypt: addr=laurenz.albe@cybertec.at; prefer-encrypt=mutual; keydata=mQINBGGDwAQBEADgbWy5cKXQld3N2mF+DFyiNFbi2oBl2T+XgxpPF8wTRw2D/u4bBKXP0SYSE/lA86jIVNWWU0gf1KODIkVvgJm2w4vH2VBV1b7ddVViGl1Iu+9zaRnv9wulhnH42KefepXnoean6UT1EzLM0opF/Ik0j+40TxdRtobkBprkQUyHDXWlHc2ffPs3SipyFEP9AVLf7ejRC46CXWDnsqjOBSMEW8Z4HiK/8RrPZBsKLts8dJxKF4pygOdJb0CWk8k/X1jbcfdxo+zOLjOMvJcSJ2pFdJmQHU+JufB3rePziqQ2S9Ur6sccr9XnTC1GVBWN4Lf5VHq+vf+bFJjVwg+2hrySZnAVfcOrxoqFLErr7ug1zN2nM1kcpgA4VWn4gxlJtYNYYq+9WxX5dtvnNANlG3ZCrRKQzl8lxtzoF6Zo7LUhEqPaHDwn7Rvs+IdbOn41lF5UDTJGqmC4gS/bZydW2Fy3YWm4aSaN9fgFf8D+PVkrlKAZB7gBLz1TyHjbcRf85cYF+GKKrDld5SzMB/V60VX3oP/Eo8ikFpyWaqiz1f9X7MBot3/PjJkY+wDzp3nmb19QEcOBuQiSQ4xds2r0HewbuHTAR68u8jNNMGmpm2j4x+g09Jd/WQDjqlTBZ/jEltH41fYCCPWMfljXTOOXu2eLNGdfi7ETZogtwjM9oTtSPQARAQABtCdMYXVyZW56IEFsYmUgPGxhdXJlbnouYWxiZUBjeWJlcnRlYy5hdD6JAk4EEwEIADgWIQR0CqhbZGGABqoaSbdi8bhXA2EdmAUCYYPABAIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRBi8bhXA2EdmM/6EADK232JCwmBzhlj8h7U9CjG6kx0JHP3uJGv+XfsHtHAlmY/RCwF1BHMEsRlk bT5UrLvJ2jb99bA9QARzhFaxzyn0F/BUKzuIjRGNs/n6d5dNUFA0kOt8sX+TacmC GEyjEBCrVCm4ranBiUyePn9NhHNWnaex7pJyqvMLLdwW9BEMJx0Fqo+DN8ukbXmYRsmhEtd3ue+x/luYmOmJnaGtzInaY5aOJYbW9XqoRIZkZvOCgbi1FfvNmoqWa+3oVxTOgw9RafjJDyW0lTHzKGjbGI5ofMU98l+/hKJFYJqWUF6VpFJY5YIcN/1lf4ZICMwDl+MPIVo/tpq8L10seJL28nLlvw3K+cI+TVW8IW/qL/LyVoDofI3USeOORuYmhpWRhik8JXX6xf3v6GrRilJIPWNFIJbxm1ZblQiQnOw3IOW7T+8nAmPin1HKqM3VrOrJQ2VtShsefNBibNAsr1oFaqcDBkn3yGG8i6CTW+FyO4PZ+/EwNxMVgktxbYdy5AT1/lpXr5tB+phhLIyVfiBvrWs5EThxYMQ/L8Y85c3GMsAy1l/x4h3jqySIYy3SCU9+jc5UVuNnXljbvkEzJ+NLWJ6C1rACFWrMszgPdh5tCrlRY9PpmYll4JbCgb8BtxEIUmR+xr50/ZElEK5iml7Q00KUekCcDt+36PsyGFTXBzNOrkCDQRhg8AEARAAzOZ2tLHlI4rrhG411h6cdCFjBZxuljaFCxFyHn3m6wbGLqwBUWC5k8UrRqjHMz88KcTSaNO7XGAmCqPdWd2SeflPZRnNTbjsVpw7mLdffsBm4JX7kki2Pvk5h0NtYeidXT1PSpc2ri4DutYXuT9uD8RAm1wUDCE5HQNUihT/WH6opt+hskHW21uHao0+y822tG0QQcGMqdQR5Vxdxj89wiEPdqW+HpU/oOZIhrf2E7prduAppxixjHy/o1rcnoznnJvc8D3+YgI9O0LrBMij89dM55pRGbLovTR1oGR3U74sX774+0xmSzeIKwZfiMUz7Atlvfk5SHOsRUFPN2Ux9kaXiiBibQpHFxt7b lDrT4wxdLJ/XCdbPPAyl+lZtOLsaHEEZvYNyTXwZc35dVf3R4/oz20HoG6s7ct8e1 AQygj43XAERzty9SkWgxs8+grp1PrGx6FHVSYRqBM8dS/ZR6yRVwOwJXPyaSSqfIF21DkE4j1y4n+ItSewPGoRp8K/yWCikt6qlkVkO2ASNIiX04fAbtzwVOaNn8ZMRNqyvLc1fED4sr49onE4cAIcBLjcC3KL+w9DUGRQCdziROj5H2Yl/sXGPdMciUHo/Uz2rggc+2th3bQiMhrHWSsBpUkDQp0yWewemstPpPgBL3h2fHKaX8B9oH5Qu/H1IgrOuX8AEQEAAYkCNgQYAQgAIBYhBHQKqFtkYYAGqhpJt2LxuFcDYR2YBQJhg8AEAhsMAAoJEGLxuFcDYR2YuPwQAMkpGtR80pQ1gVsONhdkqj0H2eU66efP/gO3CoyaoIcvrpKYj7C2HipVSmkt1gpByL0X4AMQ/vKuknUz3wd28Ba+G1dCfbVs/Xiusq+SmpUj5rTwmYqdSjWMuCo1R6oS5hdJMdUUJYGMT0QkVlm1KnW8jkmCTl9GzjDxOAsN9O6/6lPzaGFtk9XF+34Bry/N4HKiJkqpC4+UTd0AprPfzJ2jdT64e1F0+W88X8y1bTTgNrHwK4mDiLnlE4SKRuEm54lNhJz//ar86Or5BErzNpM6TL7lk44QS06hwsMrEdKIy8J/SYJPjfzR8tIUnKscclVpOgjKaBqC+0iFiVaRqAgfOlIEiezX6kMh5Q2FIUfqs46qWhhXjRrdKOEoStYAaikdLu5ZXr7vfb0ZaDh+ZwTQtbSMFolyOkecwI81MCdbMfT/1TqIGTOdAj5as9fAakk0jb2pXgUYQ8X1DVTR8ahSDVEaw9VTmWiSvTxvguVJ1Mb7gG4Gmh6aviDTJhfXtH4rPUNXhDLqrTH8JkJjyKROOMakIF68Hjse5vUfUxreBEOtb5r1Coa2Fe7ncJayaSE7ryrDbFqpZ 36UMAx4ulWMyqJajLNGY0DdG8qIsR5nxRhrnK/mrCidZ8F9/D3bWAl4rjtHlsztN59 +AnW5l0HsQcY9ntFL/zEBOaonjdJf Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.50.4 (3.50.4-1.fc39) MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On Sun, 2024-06-23 at 14:14 +0100, Martin Goodson wrote: > On 23/06/2024 11:49, Christoph Moench-Tegeder wrote: > > My advice would be to not use secrets stored in the database - > > that is, do not use scram-sha-256 - but use an external authentication > > system, like Kerberos (might be AD) or LDAP (might also be AD) and have > > that managed by the security team: that way all these compliance >=20 > Crikey, that would be=C2=A0 quite a lot of=C2=A0 lot of SSL/TLS to set up= . We have quite a > few (massive understatement :( ... ) PostgreSQL database clusters spread = over=C2=A0 > quite a lot (another understatement) of VMs. >=20 > The last time I suggested LDAP there was a lot of enthusiasm ... until th= ey went > down and looked at what might have to be done, after which it all became = very quiet ... Yes, LDAP is not perfect for that - for one, every connection to the databa= se would also hit the LDAP server. Kerberos or certificate authentication is probably better. For many PostgreSQL clusters and clients, that might be a lot of work. But not all your PostgreSQL databases will contain equally sensitive data. You could start with the important ones, try to automatize as much as possi= ble, and roll out the changes over time. Yours, Laurenz Albe