From: Christopher Browne <cbbrowne@acm.org>
To: pgsql-admin@postgresql.org
Subject: Re: Password Policy
Date: Sun, 11 Feb 2007 00:18:23 -0500
Message-ID: <87ejoxgtls.fsf@wolfe.cbbrowne.com> (raw)
References: <55c095e90702101155m20bf5b25h86589ba020ada545@mail.gmail.com>
<55c095e90702101446j7d17e32ahc3a9663e7f6ea73a@mail.gmail.com>
In the last exciting episode, ezequias.rocha@gmail.com ("Ezequias Rodrigues da Rocha") wrote:
> Hi list (my first post),
>
> Is there any password polity that postgresql implement ?
No, that would be a serious mistake, as it would prevent people from
having local policies that differed from the "PostgreSQL policy."
> It is possible to put a set all no administrators passwords to
> = '123456' from times and times ?
I'm not quite certain what you mean by that...
Do you mean you want to be able to set all non-administrators'
passwords to some particular value?
You could do that by setting one user's password to a particular
plaintext form, and then alter the others to match it.
Thus:
alter user stalking_horse password to '123456';
update pg_shadow set passwd = (select passwd from pg_shadow where usename = 'stalking_horse') and not usesuper;
I'm not sure that's an entirely wonderful policy, though.
> Has anyone implement a dinamic password autentication (the password
> changes according the date/month etc of a day ) ?
Well, you could use ident-based authentication, and then use some
wacky method to authenticate the user at the Unix level via PAM...
Changing passwords that often strikes me as being the wrong kind of
approach to this. Having a flurry of passwords that users can't
possibly remember is a clear route to having passwords sitting on
Post-It notes on cubicles.
I'd be much more inclined to use an unrememberable random password,
stowed in ~/.pgpass, which doesn't need to expire terribly often.
The other option would be to use ssh style keys for authentication;
that isn't possible now, but would be an attractive feature.
> Is there any function to encript, decript plain text in PostgreSQL
> and if it is aplicable ?
There is a contrib module, pgcrypto, which is quite suitable for such
purposes...
--
output = ("cbbrowne" "@" "gmail.com")
http://linuxfinances.info/info/emacs.html
The purpose of an undergraduate education at MIT is to give you a case
of post-traumatic stress syndrome that won't wear off for forty years.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: cbbrowne@acm.org, pgsql-admin@postgresql.org
Subject: Re: Password Policy
In-Reply-To: <87ejoxgtls.fsf@wolfe.cbbrowne.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox