passwordcheck_cracklib

passwordcheck_cracklib : Strengthen PostgreSQL user password checks with cracklib

Overview

Packages

Source

pig build pkg passwordcheck_cracklib;		# build rpm/deb

Install

Make sure PGDG and PIGSTY repo available:

pig repo add pgsql -u   # add both repo and update cache

Install this extension with pig:

pig install passwordcheck_cracklib;		# install via package name, for the active PG version

pig install passwordcheck_cracklib -v 18;   # install for PG 18
pig install passwordcheck_cracklib -v 17;   # install for PG 17
pig install passwordcheck_cracklib -v 16;   # install for PG 16
pig install passwordcheck_cracklib -v 15;   # install for PG 15
pig install passwordcheck_cracklib -v 14;   # install for PG 14

Config this extension to shared_preload_libraries:

shared_preload_libraries = '$libdir/passwordcheck_cracklib';

This extension does not need CREATE EXTENSION DDL command

Usage

Sources:

• 3.2.1 README
• 3.2.1 password hook
• PostgreSQL passwordcheck manual

passwordcheck_cracklib checks passwords supplied through CREATE ROLE and ALTER ROLE with CrackLib. It is a server hook library, with no SQL extension objects.

Enable the Hook

Add it to the existing preload list and restart PostgreSQL:

shared_preload_libraries = '$libdir/passwordcheck_cracklib'

Do not run CREATE EXTENSION passwordcheck_cracklib. CrackLib’s library and dictionary must be available to the PostgreSQL operating-system account.

Password Checks

CREATE ROLE app_user LOGIN PASSWORD 'password123';

Weak plaintext passwords cause an error. The hook checks length, the relationship to the username, character composition, and the CrackLib dictionary. A password passing those checks is not a guarantee of resistance to every attack.

Security Boundary

Dictionary checks require the plaintext password at password-change time. When a client supplies an already hashed password, the module cannot perform full strength checks; its remaining check is whether the password equals the username. Enforce the intended password-change path and protect the connection carrying plaintext passwords.

Existing passwords are not scanned retroactively. The hook also chains to a previously installed password-check hook; review other credential-policy libraries before loading them together.