MIME-Version: 1.0
References: <65b65e9f-b4b0-4927-b872-d24dff11449b@crashdump.ch>
 <3352511.1750691111@sss.pgh.pa.us> <5f76056a-16b8-49a7-855d-2f8490a3cfe8@crashdump.ch>
In-Reply-To: <5f76056a-16b8-49a7-855d-2f8490a3cfe8@crashdump.ch>
From: Greg Sabino Mullane <htamfids@gmail.com>
Date: Tue, 24 Jun 2025 19:20:21 -0400
Message-ID: <CAKAnmmLXLZT=UcTkHrU51Xm65ceQrT7ZCNXNHSRJS10zr7JRrw@mail.gmail.com>
Subject: Re: password rules
To: raphi <raphi@crashdump.ch>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000ca73bb063859944e"
Archived-At: <https://www.postgresql.org/message-id/CAKAnmmLXLZT%3DUcTkHrU51Xm65ceQrT7ZCNXNHSRJS10zr7JRrw%40mail.gmail.com>
Precedence: bulk

--000000000000ca73bb063859944e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Jun 23, 2025 at 2:45=E2=80=AFPM raphi <raphi@crashdump.ch> wrote:

> As of now though we cannot use PG for any PCI/DSS certified application
> because we can't enforce either complexity nor regular password changes,
>

You can, and many, many companies do, but you need a modern auth system
like Kerberos. Even if we were to put something into Postgres today (and
given the MFA and re-use requirements, it's near impossible), PCI DSS keeps
evolving and getting stricter, so keeping up with it would get harder with
each release.

Can I do something to help bringing these feature into PG? My C knowledge
> is very limited so I won't be able to provide a patch but I'd be more tha=
n
> happy to test it.


Your energy would be much better used in bringing Kerberos into your
organization. :)

Cheers,
Greg

--
Crunchy Data - https://www.crunchydata.com
Enterprise Postgres Software Products & Tech Support

--000000000000ca73bb063859944e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Mon, Jun 23, 2025 at 2:45=E2=80=AFPM r=
aphi &lt;<a href=3D"mailto:raphi@crashdump.ch">raphi@crashdump.ch</a>&gt; w=
rote:</div><div class=3D"gmail_quote gmail_quote_container"><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex">As of now though we cannot use PG for an=
y PCI/DSS certified application <br>
because we can&#39;t enforce either complexity nor regular password changes=
, <br>
</blockquote><div><br></div><div>You can, and many, many companies do, but =
you need a modern auth system like Kerberos. Even if we were to put somethi=
ng into Postgres today (and given the MFA and re-use requirements, it&#39;s=
 near impossible), PCI DSS keeps evolving and getting stricter, so keeping =
up with it would get harder with each release.</div><div><br></div><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px=
 solid rgb(204,204,204);padding-left:1ex">Can I do something to help bringi=
ng these feature into PG? My C knowledge is very limited so I won&#39;t be =
able to provide a patch but I&#39;d be more than happy to test it.</blockqu=
ote><div><br></div><div>Your energy would be much better used in bringing K=
erberos into your organization. :)</div><div><br></div><div>Cheers,</div><d=
iv>Greg</div><div><br></div></div><div dir=3D"ltr" class=3D"gmail_signature=
"><div dir=3D"ltr"><div>--</div><div>Crunchy Data - <a href=3D"https://www.=
crunchydata.com" target=3D"_blank">https://www.crunchydata.com</a></div><di=
v>Enterprise Postgres Software Products &amp; Tech Support</div><div><br></=
div></div></div></div>

--000000000000ca73bb063859944e--