MIME-Version: 1.0
References: <CAFsaSDgSPjLOmk51fZt_zYPEUnFOCQ+92g_g2OSMjNbMa4h2xg@mail.gmail.com>
 <CAKAnmmLBf33oSKxxANDztHR455BhEdO=AROGvXZa1crh7VchHg@mail.gmail.com>
 <CANzqJaDJ0_Aiih6X6AMfkRaWATFrHJMw_21oS-7im8JdN9SgrQ@mail.gmail.com>
 <20241213202348.jtchbb2lezbx2re6@hjp.at> <CAFsaSDgsJB9WpZSxspQ0CJAkT4OjGzdh+hLqnf=hinp-ywDU6g@mail.gmail.com>
In-Reply-To: <CAFsaSDgsJB9WpZSxspQ0CJAkT4OjGzdh+hLqnf=hinp-ywDU6g@mail.gmail.com>
From: Greg Sabino Mullane <htamfids@gmail.com>
Date: Mon, 16 Dec 2024 08:09:45 -0500
Message-ID: <CAKAnmmJQmpN14wCpOsM9mCEXagwWWONyA+BYszMQJ5ExxOEfXA@mail.gmail.com>
Subject: Re: Credcheck- credcheck.max_auth_failure
To: =?UTF-8?B?5by15a6455GL?= <kenny020307@gmail.com>
Cc: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000268c56062962e71f"
Archived-At: <https://www.postgresql.org/message-id/CAKAnmmJQmpN14wCpOsM9mCEXagwWWONyA%2BBYszMQJ5ExxOEfXA%40mail.gmail.com>
Precedence: bulk

--000000000000268c56062962e71f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Dec 16, 2024 at 5:32=E2=80=AFAM =E5=BC=B5=E5=AE=B8=E7=91=8B <kenny0=
20307@gmail.com> wrote:

> We have both regular accounts and system accounts. For regular accounts,
> we still require password complexity and the lockout functionality after
> multiple failed login attempts.
>

Again, what is the threat model here? Most people have their password in a
.pgpass file or similar, so it seems this only adds complexity and
annoyance without any real benefit.

However, for system accounts, due to information security regulations,
> password complexity is also required.
>

Yes, this makes sense.


> The issue is that system accounts are used for system integration, and if
> the account gets locked, it may affect system services, which could lead =
to
> problems. To prevent this, we would like to exclude system accounts from
> being affected by the credcheck.max_auth_failure parameter.
>

I think we all understand that, but the extension as it exists now cannot
do that. And the obvious and easiest solution is to stop using the denial
of service feature, which I am hoping is NOT mandated by security
regulations.

Cheers,
Greg

--000000000000268c56062962e71f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Mon, Dec 16, 2024 at 5:32=E2=80=AFAM =
=E5=BC=B5=E5=AE=B8=E7=91=8B &lt;<a href=3D"mailto:kenny020307@gmail.com">ke=
nny020307@gmail.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quo=
te_container"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px=
 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div>W=
e have both regular accounts and system accounts. For regular accounts, we =
still require password complexity and the lockout functionality after multi=
ple failed login attempts.</div></div></blockquote><div><br></div><div>Agai=
n, what is the threat model here? Most people have their password in a .pgp=
ass file or similar, so it seems this only adds complexity and annoyance wi=
thout any real benefit.</div><div><br></div><blockquote class=3D"gmail_quot=
e" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204)=
;padding-left:1ex"><div><div> However, for system accounts, due to informat=
ion security regulations, password complexity is also required.</div></div>=
</blockquote><div><br></div><div>Yes, this makes sense.</div><div>=C2=A0</d=
iv><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bord=
er-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div> The issue i=
s that system accounts are used for system integration, and if the account =
gets locked, it may affect system services, which could lead to problems. T=
o prevent this, we would like to exclude system accounts from being affecte=
d by the credcheck.max_auth_failure parameter.</div></div></blockquote><div=
><br></div><div>I think we all understand that, but the extension as it exi=
sts now cannot do that. And the obvious and easiest solution=C2=A0is to sto=
p using the denial of service feature, which I am hoping is NOT mandated by=
 security regulations.</div><div><br></div><div>Cheers,</div><div>Greg</div=
><div><br></div></div></div>

--000000000000268c56062962e71f--