MIME-Version: 1.0
References: <CAFsaSDgSPjLOmk51fZt_zYPEUnFOCQ+92g_g2OSMjNbMa4h2xg@mail.gmail.com>
In-Reply-To: <CAFsaSDgSPjLOmk51fZt_zYPEUnFOCQ+92g_g2OSMjNbMa4h2xg@mail.gmail.com>
From: Greg Sabino Mullane <htamfids@gmail.com>
Date: Wed, 11 Dec 2024 12:57:06 -0500
Message-ID: <CAKAnmmLBf33oSKxxANDztHR455BhEdO=AROGvXZa1crh7VchHg@mail.gmail.com>
Subject: Re: Credcheck- credcheck.max_auth_failure
To: =?UTF-8?B?5by15a6455GL?= <kenny020307@gmail.com>
Cc: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="00000000000091d8cf06290255e2"
Archived-At: <https://www.postgresql.org/message-id/CAKAnmmLBf33oSKxxANDztHR455BhEdO%3DAROGvXZa1crh7VchHg%40mail.gmail.com>
Precedence: bulk

--00000000000091d8cf06290255e2
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Dec 11, 2024 at 5:46=E2=80=AFAM =E5=BC=B5=E5=AE=B8=E7=91=8B <kenny0=
20307@gmail.com> wrote:

> In the use of the Credcheck suite, the parameter
> "credcheck.max_auth_failure =3D '3'" is set in the postgresql.conf file t=
o
> limit users from entering incorrect passwords more than three times, afte=
r
> which their account will be locked.
>

Won't that allow absolutely anyone to lock out anyone else, including
admins/superusers? Sounds like a bad idea to me.


> Due to certain requirements, I would like to ask if there is a way or
> feature to set this parameter differently for a specific user or role, so
> that it does not apply to them.
>

There is not, but there is always the credcheck.reset_superuser setting as
an emergency measure. I'd keep the password complexity settings and not
enable max_auth_failure at all, myself. Three strikes and you're out feels
pretty draconian. Is there a particular threat model that is driving that?

Cheers,
Greg

--00000000000091d8cf06290255e2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Wed, Dec 11, 2024 at 5:46=E2=80=AFAM =
=E5=BC=B5=E5=AE=B8=E7=91=8B &lt;<a href=3D"mailto:kenny020307@gmail.com">ke=
nny020307@gmail.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quo=
te_container"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px=
 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div>I=
n the use of the Credcheck suite, the parameter &quot;credcheck.max_auth_fa=
ilure =3D &#39;3&#39;&quot; is set in the postgresql.conf file to limit use=
rs from entering incorrect passwords more than three times, after which the=
ir account will be locked.</div></div></blockquote><div><br></div><div>Won&=
#39;t that allow absolutely anyone to lock out anyone else, including admin=
s/superusers? Sounds like a bad idea to me.</div><div>=C2=A0</div><blockquo=
te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex"><div><div> Due to certain requirem=
ents, I would like to ask if there is a way or feature to set this paramete=
r differently for a specific user or role, so that it does not apply to the=
m.</div></div></blockquote><div><br></div><div>There is not, but there is a=
lways the=C2=A0credcheck.reset_superuser setting as an emergency measure. I=
&#39;d keep the password complexity settings and not enable max_auth_failur=
e at all, myself. Three strikes and you&#39;re out feels pretty draconian. =
Is there a particular=C2=A0threat model that is driving that?</div><div><br=
></div><div>Cheers,</div><div>Greg</div><div><br></div><blockquote class=3D=
"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(2=
04,204,204);padding-left:1ex"><div>
</div>
</blockquote></div></div>

--00000000000091d8cf06290255e2--