MIME-Version: 1.0
References: <CAFsaSDgSPjLOmk51fZt_zYPEUnFOCQ+92g_g2OSMjNbMa4h2xg@mail.gmail.com>
 <CAKAnmmLBf33oSKxxANDztHR455BhEdO=AROGvXZa1crh7VchHg@mail.gmail.com>
 <CANzqJaDJ0_Aiih6X6AMfkRaWATFrHJMw_21oS-7im8JdN9SgrQ@mail.gmail.com>
 <20241213202348.jtchbb2lezbx2re6@hjp.at> <CAFsaSDgsJB9WpZSxspQ0CJAkT4OjGzdh+hLqnf=hinp-ywDU6g@mail.gmail.com>
 <CAKAnmmJQmpN14wCpOsM9mCEXagwWWONyA+BYszMQJ5ExxOEfXA@mail.gmail.com>
In-Reply-To: <CAKAnmmJQmpN14wCpOsM9mCEXagwWWONyA+BYszMQJ5ExxOEfXA@mail.gmail.com>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Mon, 16 Dec 2024 09:13:16 -0500
Message-ID: <CANzqJaB1mFKUP=_kFqg2CtSN6QSMkgsMTvYtQnoGJ7cLAhhjyQ@mail.gmail.com>
Subject: Re: Credcheck- credcheck.max_auth_failure
To: Greg Sabino Mullane <htamfids@gmail.com>
Cc: =?UTF-8?B?5by15a6455GL?= <kenny020307@gmail.com>, 
	pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000ccb345062963c842"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaB1mFKUP%3D_kFqg2CtSN6QSMkgsMTvYtQnoGJ7cLAhhjyQ%40mail.gmail.com>
Precedence: bulk

--000000000000ccb345062963c842
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Dec 16, 2024 at 8:10=E2=80=AFAM Greg Sabino Mullane <htamfids@gmail=
.com>
wrote:

> On Mon, Dec 16, 2024 at 5:32=E2=80=AFAM =E5=BC=B5=E5=AE=B8=E7=91=8B <kenn=
y020307@gmail.com> wrote:
>
>> We have both regular accounts and system accounts. For regular accounts,
>> we still require password complexity and the lockout functionality after
>> multiple failed login attempts.
>>
>
> Again, what is the threat model here?
>

I would not be surprised if the "threat model" is security auditors.


> Most people have their password in a .pgpass file or similar, so it seems
> this only adds complexity and annoyance without any real benefit.
>

Mostly, people *do not* log into our PG instances. 99% of connections are
from application service accounts via JDBC.

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--000000000000ccb345062963c842
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Mon, Dec 16, 2024 at 8:10=E2=80=AFAM G=
reg Sabino Mullane &lt;<a href=3D"mailto:htamfids@gmail.com">htamfids@gmail=
.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container"><=
blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l=
eft:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=
=3D"ltr">On Mon, Dec 16, 2024 at 5:32=E2=80=AFAM =E5=BC=B5=E5=AE=B8=E7=91=
=8B &lt;<a href=3D"mailto:kenny020307@gmail.com" target=3D"_blank">kenny020=
307@gmail.com</a>&gt; wrote:</div><div class=3D"gmail_quote"><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex"><div><div>We have both regular accounts=
 and system accounts. For regular accounts, we still require password compl=
exity and the lockout functionality after multiple failed login attempts.</=
div></div></blockquote><div><br></div><div>Again, what is the threat model =
here? </div></div></div></blockquote><div><br></div><div>I would not be sur=
prised if the &quot;threat model&quot; is security auditors.</div><div>=C2=
=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8e=
x;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"=
><div class=3D"gmail_quote"><div>Most people have their password in a .pgpa=
ss file or similar, so it seems this only adds complexity and annoyance wit=
hout any real benefit.</div></div></div></blockquote><div><br></div><div>Mo=
stly, people <i>do not</i>=C2=A0log into our PG instances. 99% of connectio=
ns are from application service accounts via JDBC.</div><div><br></div></di=
v><span class=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" cla=
ss=3D"gmail_signature"><div dir=3D"ltr">Death to &lt;Redacted&gt;, and butt=
er sauce.<div>Don&#39;t boil me, I&#39;m still alive.<br><div><div>&lt;Reda=
cted&gt; lobster!</div></div></div></div></div></div>

--000000000000ccb345062963c842--