MIME-Version: 1.0
References: <79692c1a-190c-413e-9442-a14a45c1069d@googlemail.com>
In-Reply-To: <79692c1a-190c-413e-9442-a14a45c1069d@googlemail.com>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Sat, 22 Jun 2024 22:38:12 -0400
Message-ID: <CANzqJaBT+LPunvKPX=88s9xPDCOyJnTHK_Tpv8K85mchLnyStA@mail.gmail.com>
Subject: Re: Password complexity/history - credcheck?
To: pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000f49561061b858e07"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaBT%2BLPunvKPX%3D88s9xPDCOyJnTHK_Tpv8K85mchLnyStA%40mail.gmail.com>
Precedence: bulk

--000000000000f49561061b858e07
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sat, Jun 22, 2024 at 7:28=E2=80=AFPM Martin Goodson <kaemaril@googlemail=
.com>
wrote:

> Hello.
>
> Recently our security team have wanted to apply password complexity
> checks akin to Oracle's profile mechanism to PostgreSQL, checking that a
> password hasn't been used in x months


There would have to be a pg_catalog table which stores login history.


> etc, has minimum length, x special
> characters and x numeric characters, mixed case etc.
>

Is that an after-the-fact scanner (with all the problems Tom mentioned), or
is it a client-side "check while you're typing in the *new* password"
scanner?

--000000000000f49561061b858e07
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sat, Jun 22, 2024 at 7:28=E2=80=AFPM M=
artin Goodson &lt;<a href=3D"mailto:kaemaril@googlemail.com">kaemaril@googl=
email.com</a>&gt; wrote:<br></div><div class=3D"gmail_quote"><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex">Hello.<br>
<br>
Recently our security team have wanted to apply password complexity <br>
checks akin to Oracle&#39;s profile mechanism to PostgreSQL, checking that =
a <br>
password hasn&#39;t been used in x months</blockquote><div><br></div><div>T=
here would have to be a pg_catalog table which stores login history.<br></d=
iv><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0=
px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> etc,=
 has minimum length, x special <br>
characters and x numeric characters, mixed case etc.<br></blockquote><div><=
br></div><div>Is that an after-the-fact scanner (with all the problems Tom =
mentioned), or is it a client-side &quot;check while you&#39;re typing in t=
he <b>new</b> password&quot; scanner?</div><div><br></div></div></div>

--000000000000f49561061b858e07--