| F.35. passwordcheck — verify password strength | ||||
|---|---|---|---|---|
| Prev | Up | Appendix F. Additional Supplied Modules and Extensions Shipped inpostgrespro-std-17-contrib | Home | Next |
F.35. passwordcheck — verify password strength#
Thepasswordcheck module checks users' passwords whenever they are set withCREATE ROLE orALTER ROLE (it doesn't work, if a non-default profile is assigned to the user). If a password is considered too weak, it will be rejected and the command will terminate with an error.
To enable this module, add'$libdir/passwordcheck' toshared_preload_libraries inpostgresql.conf, then restart the server.
Caution
To prevent unencrypted passwords from being sent across the network, written to the server log or otherwise stolen by a database administrator,Postgres Pro allows the user to supply pre-encrypted passwords. Many client programs make use of this functionality and encrypt the password before sending it to the server.
This limits the usefulness of thepasswordcheck module, because in that case it can only try to guess the password. For this reason,passwordcheck is not recommended if your security requirements are high. It is more secure to use an external authentication method such as GSSAPI (seeChapter 19) than to rely on passwords within the database.