From: | Greg Sabino Mullane <htamfids(at)gmail(dot)com> |
---|---|
To: | 張宸瑋 <kenny020307(at)gmail(dot)com> |
Cc: | pgsql-general(at)lists(dot)postgresql(dot)org |
Subject: | Re: Credcheck- credcheck.max_auth_failure |
Date: | 2024-12-11 17:57:06 |
Message-ID: | CAKAnmmLBf33oSKxxANDztHR455BhEdO=AROGvXZa1crh7VchHg@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-general |
On Wed, Dec 11, 2024 at 5:46 AM 張宸瑋 <kenny020307(at)gmail(dot)com> wrote:
> In the use of the Credcheck suite, the parameter
> "credcheck.max_auth_failure = '3'" is set in the postgresql.conf file to
> limit users from entering incorrect passwords more than three times, after
> which their account will be locked.
>
Won't that allow absolutely anyone to lock out anyone else, including
admins/superusers? Sounds like a bad idea to me.
> Due to certain requirements, I would like to ask if there is a way or
> feature to set this parameter differently for a specific user or role, so
> that it does not apply to them.
>
There is not, but there is always the credcheck.reset_superuser setting as
an emergency measure. I'd keep the password complexity settings and not
enable max_auth_failure at all, myself. Three strikes and you're out feels
pretty draconian. Is there a particular threat model that is driving that?
Cheers,
Greg
From | Date | Subject | |
---|---|---|---|
Next Message | Ron Johnson | 2024-12-11 18:43:38 | Re: Credcheck- credcheck.max_auth_failure |
Previous Message | Adrian Klaver | 2024-12-11 16:41:02 | Re: Credcheck- credcheck.max_auth_failure |