Subject: Password settings requirements

From: Agil Azimov <[email-masked]>
Date: Tue, 12 Oct 2021 19:00:17 +0400

Hi,

Need to check the password settings in postgre such as Password minimal
length, password complexity, password maximal age, password history and
account lockout threshold.

I need to set these parameters to make the comply with the best practices

Can you please help with this issue?

---

From: hubert depesz lubaczewski <[email-masked]>
Date: Tue, 12 Oct 2021 17:26:01 +0200

> Can you please help with this issue?

Did you check this:
https://www.postgresql.org/docs/current/passwordcheck.html ?

Best regards,

depesz

---

From: Tom Lane <[email-masked]>
Date: Tue, 12 Oct 2021 11:53:38 -0400

> I need to set these parameters to make the comply with the best practices

If you're intent on doing things that way, you can set up Postgres
to use PAM authentication, and then the PAM end of things can be
configured with all kinds of options like that.

Personally though, I'd push back on those requirements.  The fundamental
problem with doing anything like that is that you cannot check password
length, complexity, etc without users having to send their cleartext
passwords to the server, which is a much bigger security fail than
anything appearing on your list.  Best practice these days is to use
SCRAM, which never exposes the cleartext password to the server.

			regards, tom lane

---

From: Agil Azimov <[email-masked]>
Date: Tue, 12 Oct 2021 20:43:30 +0400

Yes I have checked it. The passwordcheck sets the predefined parameters
which cannot be observed. I read somwhere that there is complexity check
and password minimal length is set to 8 symbols. This doesn't work for me

---

From: Agil Azimov <[email-masked]>
Date: Tue, 12 Oct 2021 20:46:44 +0400

Thank you for your message. Will I be able to set all the settings I
mentioned before if I will set SCRAM?

---

From: Bruce Momjian <[email-masked]>
Date: Tue, 12 Oct 2021 19:28:23 -0400

On Tue, Oct 12, 2021 at 08:46:44PM +0400, Agil Azimov wrote:
> Thank you for your message. Will I be able to set all the settings I mentioned
> before if I will set SCRAM?

No.  I think you need to use PAM or something like that if you want
those requirements.

-- 
  Bruce Momjian  <[email-masked]>        https://momjian.us
  EDB                                      https://enterprisedb.com

  If only the physical world exists, free will is an illusion.

---

From: Agil Azimov <[email-masked]>
Date: Tue, 19 Oct 2021 11:38:17 +0400

Thank you for your reply! I would like to check the current password
requirements of PostgreSQL server. Could you please let me know which
command will show me the
1. Minimal requirements for password length
2. Maximum password age
3. If the password complexity requirements are turned on.
4. Password history requirement - number of passwords
5. Account lockout threshold.

I appreciate you support.

---

From: Agil Azimov <[email-masked]>
Date: Tue, 19 Oct 2021 11:45:13 +0400

I know that the authentication md5 is used .

---

From: Laurenz Albe <[email-masked]>
Date: Tue, 19 Oct 2021 14:20:01 +0200

On Tue, 2021-10-19 at 11:38 +0400, Agil Azimov wrote:
> Thank you for your reply! I would like to check the current password requirements of PostgreSQL server. Could you please let me know which command will show me the

As Bruce said, there are no such requirements.
You will have to manage your passwords outside of PostgreSQL if
you need to impose password rules.
PAM, the pluggabla authentication mocule of Linux, is one way of doing that.

Yours,
Laurenz Albe
-- 
Cybertec | https://www.cybertec-postgresql.com

---

From: Agil Azimov <[email-masked]>
Date: Tue, 19 Oct 2021 17:01:54 +0400

Thank you for the clarification!  The issue is that I have to check and
report the current state )). Is there any way I can check current password
settings (minimal password length for instance and maximum password
lifetime).  Ideally all of the settings mentioned above ). I appreciate any
help you can provide.

Warm regards,
Agil

---

From: Laurenz Albe <[email-masked]>
Date: Tue, 19 Oct 2021 15:52:25 +0200

On Tue, 2021-10-19 at 17:01 +0400, Agil Azimov wrote:
> Is there any way I can check current password settings (minimal password length for instance and maximum password lifetime).

No.  Not in PostgreSQL.
It doesn't help if you ask the question again.

Yours,
Laurenz Albe

---

From: Agil Azimov <[email-masked]>
Date: Tue, 19 Oct 2021 17:59:46 +0400

Ok, thanks ))) sorry for asking the same question too many times .

On Tue, Oct 19, 2021 at 5:52 PM Laurenz Albe <[email-masked]>
wrote:

> > Is there any way I can check current password settings (minimal password
> length for instance and maximum password lifetime).
>
> No.  Not in PostgreSQL.