Date: Mon, 24 Jun 2024 17:01:47 +0200
From: Christoph Moench-Tegeder <cmt@burggraben.net>
To: Martin Goodson <kaemaril@googlemail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, pgsql-general@lists.postgresql.org
Subject: Re: Password complexity/history - credcheck?
Message-ID: <ZnmKW201PpfJmNpy@sciurus.exwg.net>
References: <79692c1a-190c-413e-9442-a14a45c1069d@googlemail.com>
 <834558.1719102188@sss.pgh.pa.us>
 <43826fbd-2d26-467b-afcf-7fde609f8da3@googlemail.com>
 <Znf9oBPO8dJWHSEi@elch.exwg.net>
 <de507f6d-2c3b-4f35-9eda-99b81e2a1083@googlemail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <de507f6d-2c3b-4f35-9eda-99b81e2a1083@googlemail.com>
User-Agent: Mutt/2.2.12 (2023-09-09)
Archived-At: <https://www.postgresql.org/message-id/ZnmKW201PpfJmNpy%40sciurus.exwg.net>
Precedence: bulk

## Martin Goodson (kaemaril@googlemail.com):

> Crikey, that would be  quite a lot of  lot of SSL/TLS to set up. We
> have quite a few (massive understatement :( ... ) PostgreSQL database
> clusters spread over quite a lot (another understatement) of VMs.

No matter what: you'll have to touch all your instances anyways.
The good thing is that all the options (including TLS) can be
automatically deployed iff you're set up for that - and you should
be, especially when you have "many" databases.

> The last time I suggested LDAP there was a lot of enthusiasm ... until
> they went down and looked at what might have to be done, after which
> it all became very quiet ...

With "many" databases and personal accounts, you should have some
sort of central management (else even an inventory of the accounts
("who can access what") is a nightmare). Finding the best ways towards
that goal for your organization could be beyond the scope of an email
list - but I'd start with looking at what you already have. I mentioned
LDAP because all too often that's the system which you can most easily
get access to (but depending on your environment, that might mot be
the best solution).

Regards,
Christoph

-- 
Spare Space.