Documentazione di PostgreSQL 9.0 > Appendici > Additional Supplied Modules > passwordcheck
Precedentepageinspectpg_archivecleanupSuccessivo

F.21. passwordcheck

The passwordcheck module checks users' passwords whenever they are set with CREATE ROLE(7) or ALTER ROLE(7). If a password is considered too weak, it will be rejected and the command will terminate with an error.

To enable this module, add '$libdir/passwordcheck' to shared_preload_libraries in postgresql.conf, then restart the server.

You can adapt this module to your needs by changing the source code. For example, you can use CrackLib to check passwords -- this only requires uncommenting two lines in the Makefile and rebuilding the module. (We cannot include CrackLib™ by default for license reasons.) Without CrackLib™, the module enforces a few simple rules for password strength, which you can modify or extend as you see fit.

[Attenzione]

Attenzione

To prevent unencrypted passwords from being sent across the network, written to the server log or otherwise stolen by a database administrator, PostgreSQL™ allows the user to supply pre-encrypted passwords. Many client programs make use of this functionality and encrypt the password before sending it to the server.

This limits the usefulness of the passwordcheck module, because in that case it can only try to guess the password. For this reason, passwordcheck is not recommendable if your security requirements are high. It is more secure to use an external authentication method such as Kerberos (see Capitolo 19, Client Authentication) than to rely on passwords within the database.

Alternatively, you could modify passwordcheck to reject pre-encrypted passwords, but forcing users to set their passwords in clear text carries its own security risks.

Documentazione di PostgreSQL 9.0 > Appendici > Additional Supplied Modules > passwordcheck
Precedentepageinspectpg_archivecleanupSuccessivo