Content-Type: multipart/alternative;
 boundary="------------WS9p54zu0CBK0w9i9vnTVOo3"
Message-ID: <de507f6d-2c3b-4f35-9eda-99b81e2a1083@googlemail.com>
Date: Sun, 23 Jun 2024 14:14:43 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Password complexity/history - credcheck?
To: Christoph Moench-Tegeder <cmt@burggraben.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, pgsql-general@lists.postgresql.org
References: <79692c1a-190c-413e-9442-a14a45c1069d@googlemail.com>
 <834558.1719102188@sss.pgh.pa.us>
 <43826fbd-2d26-467b-afcf-7fde609f8da3@googlemail.com>
 <Znf9oBPO8dJWHSEi@elch.exwg.net>
Content-Language: en-GB
From: Martin Goodson <kaemaril@googlemail.com>
In-Reply-To: <Znf9oBPO8dJWHSEi@elch.exwg.net>
Archived-At: <https://www.postgresql.org/message-id/de507f6d-2c3b-4f35-9eda-99b81e2a1083%40googlemail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------WS9p54zu0CBK0w9i9vnTVOo3
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 23/06/2024 11:49, Christoph Moench-Tegeder wrote:

> My advice would be to not use secrets stored in the database -
> that is, do not use scram-sha-256 - but use an external authentication
> system, like Kerberos (might be AD) or LDAP (might also be AD) and have
> that managed by the security team: that way all these compliance

Crikey, that would be  quite a lot of  lot of SSL/TLS to set up. We have 
quite a few (massive understatement :( ... ) PostgreSQL database 
clusters spread over quite a lot (another understatement) of VMs.

The last time I suggested LDAP there was a lot of enthusiasm ... until 
they went down and looked at what might have to be done, after which it 
all became very quiet ...

Regards,

Martin.


--------------WS9p54zu0CBK0w9i9vnTVOo3
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>On 23/06/2024 11:49, Christoph Moench-Tegeder wrote:</p>
    <blockquote type="cite" cite="mid:Znf9oBPO8dJWHSEi@elch.exwg.net"><span
      style="white-space: pre-wrap">
</span>
      <pre class="moz-quote-pre" wrap="">My advice would be to not use secrets stored in the database -
that is, do not use scram-sha-256 - but use an external authentication
system, like Kerberos (might be AD) or LDAP (might also be AD) and have
that managed by the security team: that way all these compliance
</pre>
    </blockquote>
    <p>Crikey, that would be  quite a lot of  lot of SSL/TLS to set up.
      We have quite a few (massive understatement :( ... ) PostgreSQL
      database clusters spread over quite a lot (another understatement)
      of VMs.</p>
    <p>The last time I suggested LDAP there was a lot of enthusiasm ...
      until they went down and looked at what might have to be done,
      after which it all became very quiet ... <br>
    </p>
    <p>Regards,</p>
    <p>Martin.</p>
    <p><br>
    </p>
    <p><span style="white-space: pre-wrap">
</span></p>
    <p><span style="white-space: pre-wrap">
</span></p>
  </body>
</html>

--------------WS9p54zu0CBK0w9i9vnTVOo3--