Does PostgresSQL have any default password policy?

user_1013388 0
Viewed 6137

I've looked around and haven't found the basic Password requirements, if any, for PostgreSQL. That is, chars allowed, length, casing, etc...

Will someone please point me to these, if they exist?

Thanks

passwords postgresql
1 Answers

The best you can do on the server is to use the passwordcheck contrib module. You probably have to hack it up to fix your needs.

However, that won't be able to enforce password policies in general, because the server never sees the clear text password unless you change it with

ALTER ROLE xy PASSWORD 'clear_text';

which is not recommended. Changing the password with tools like psql's \password command will hash the password before it is sent to the server, so the server cannot enforce any password rules.

You would have to check the password on the client, but naturally the client is not under your control, unless you restrict severely what people can do on their machines (and people usually find ways around such restrictions).

So there is really no way to do what you want.

What you can do is enable cracklib in the passwordcheck module and this way test the hashed passwords against a dictionary.

For good security, use something like LDAP or Kerberos authentication and implement your password policy there.

user_64643080
Related