credcheck
credcheck
credcheck : credcheck - postgresql plain text credential checker
Overview
| ID | Extension | Package | Version | Category | License | Language |
|---|---|---|---|---|---|---|
| 7310 | credcheck | credcheck | 4.6 | SEC | MIT | C |
| Attribute | Has Binary | Has Library | Need Load | Has DDL | Relocatable | Trusted |
|---|---|---|---|---|---|---|
--sLd-- | No | Yes | Yes | Yes | no | no |
| Relationships | |
|---|---|
| See Also | passwordcheck_cracklib login_hook passwordcheck pgaudit pg_auth_mon set_user auth_delay pg_permissions |
Packages
| Type | Repo | Version | PG Major Compatibility | Package Pattern | Dependencies |
|---|---|---|---|---|---|
| EXT | PGDG | 4.6 | 18 17 16 15 14 | credcheck | - |
| RPM | PGDG | 4.6 | 18 17 16 15 14 | credcheck_$v | - |
| DEB | PGDG | 4.6 | 18 17 16 15 14 | postgresql-$v-credcheck | - |
| Linux / PG | PG18 | PG17 | PG16 | PG15 | PG14 |
|---|---|---|---|---|---|
el8.x86_64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
el8.aarch64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
el9.x86_64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
el9.aarch64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
el10.x86_64 | PGDG 4.5 | PGDG 4.5 | PGDG 4.5 | PGDG 4.5 | PGDG 4.5 |
el10.aarch64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
d12.x86_64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
d12.aarch64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
d13.x86_64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
d13.aarch64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
u22.x86_64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
u22.aarch64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
u24.x86_64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
u24.aarch64 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 | PGDG 4.6 |
Source
Install
Make sure PGDG repo available:
pig repo add pgdg -u # add pgdg repo and update cacheInstall this extension with pig:
pig install credcheck; # install via package name, for the active PG version
pig install credcheck -v 18; # install for PG 18
pig install credcheck -v 17; # install for PG 17
pig install credcheck -v 16; # install for PG 16
pig install credcheck -v 15; # install for PG 15
pig install credcheck -v 14; # install for PG 14Config this extension to shared_preload_libraries:
shared_preload_libraries = 'credcheck';Create this extension with:
CREATE EXTENSION credcheck;Usage
credcheck: Credential checking for PostgreSQL usernames and passwords
credcheck enforces configurable rules for username and password strength during CREATE ROLE, ALTER ROLE, and password changes. It also supports password reuse policies and authentication failure banning.
Configuration Parameters
Add to postgresql.conf:
shared_preload_libraries = 'credcheck'Username Checks
| Parameter | Description | Example |
|---|---|---|
credcheck.username_min_length | Minimum username length | 4 |
credcheck.username_min_special | Minimum special characters | 1 |
credcheck.username_min_digit | Minimum digit characters | 1 |
credcheck.username_min_upper | Minimum uppercase characters | 2 |
credcheck.username_min_lower | Minimum lowercase characters | 1 |
credcheck.username_min_repeat | Max adjacent repeat characters | 2 |
credcheck.username_contain | Must contain one of these chars | a,b,c |
credcheck.username_not_contain | Must not contain these chars | x,y,z |
credcheck.username_contain_password | Username must not contain password | on |
Password Checks
| Parameter | Description | Example |
|---|---|---|
credcheck.password_min_length | Minimum password length | 8 |
credcheck.password_min_special | Minimum special characters | 1 |
credcheck.password_min_digit | Minimum digit characters | 1 |
credcheck.password_min_upper | Minimum uppercase characters | 1 |
credcheck.password_min_lower | Minimum lowercase characters | 1 |
credcheck.password_min_repeat | Max adjacent repeat characters | 3 |
credcheck.password_contain_username | Password must not contain username | on |
credcheck.password_valid_until | Minimum days for VALID UNTIL | 60 |
credcheck.password_valid_max | Maximum days for VALID UNTIL | 365 |
credcheck.whitelist | Usernames excluded from checks | admin,super |
Examples
-- Rejected: username too short
CREATE USER abc WITH PASSWORD 'pass';
-- ERROR: username length should match the configured credcheck.username_min_length
-- Rejected: password contains username
CREATE USER abcd$ WITH PASSWORD 'abcd$xyz';
-- ERROR: password should not contain usernamePassword Reuse Policy
SET credcheck.password_reuse_history = 2;
SET credcheck.password_reuse_interval = 365; -- daysView password history:
SELECT rolename, password_hash FROM pg_password_history;Authentication Failure Ban
SET credcheck.max_auth_failure = 3; -- ban after 3 failuresReset banned users:
SELECT pg_banned_role_reset(); -- reset all
SELECT pg_banned_role_reset('username'); -- reset specific userLast updated on