passwordpolicy

passwordpolicy : Dynamically configurable PostgreSQL password complexity checks.

Overview

Packages

Source

pig build pkg passwordpolicy;		# build rpm/deb

Install

Make sure PGDG repo available:

pig repo add pgdg -u    # add pgdg repo and update cache

Install this extension with pig:

pig install passwordpolicy;		# install via package name, for the active PG version

pig install passwordpolicy -v 18;   # install for PG 18
pig install passwordpolicy -v 17;   # install for PG 17
pig install passwordpolicy -v 16;   # install for PG 16
pig install passwordpolicy -v 15;   # install for PG 15
pig install passwordpolicy -v 14;   # install for PG 14

Config this extension to shared_preload_libraries:

shared_preload_libraries = '$libdir/passwordpolicy';

Create this extension with:

CREATE EXTENSION passwordpolicy;

Usage

Sources: README, v2.0.5 release, control file

passwordpolicy is a configurable replacement for PostgreSQL’s passwordcheck module. It checks passwords during CREATE ROLE and ALTER ROLE, can enforce password history and validity rules, and can simulate soft account locks after repeated failed logins.

Enable The Hook

Load the module before other password-check modules, then restart PostgreSQL:

shared_preload_libraries = 'passwordpolicy'

Install the SQL extension in the postgres database when using account soft-lock or password-history features:

CREATE EXTENSION passwordpolicy;

Password Complexity

Settings are dynamic, but new values apply to new sessions:

password_policy.min_password_len = 15
password_policy.min_special_chars = 1
password_policy.min_numbers = 1
password_policy.min_uppercase_letter = 1
password_policy.min_lowercase_letter = 1
password_policy.require_validuntil = off

Enable CrackLib dictionary checks only after creating the dictionary file:

password_policy.cracklib_dictpath = '/var/cache/cracklib/postgresql_dict'
password_policy.enable_dictionary_check = on

Soft Account Lock

Soft-locking tracks failed login attempts and delays/rejects responses after the configured threshold:

password_policy_lock.number_failures = 5
password_policy_lock.failure_delay = 5
password_policy_lock.auto_unlock = on
password_policy_lock.auto_unlock_after = 0
password_policy_lock.max_number_accounts = 100

Inspect and reset lock state:

SELECT * FROM passwordpolicy.accounts_locked() ORDER BY usename;
SELECT passwordpolicy.account_locked_reset('app_user');

If password_policy_lock.include_all = false, only roles listed in passwordpolicy.accounts_lockable are considered for soft-lock.

Password History

Password history stores recent password hashes in the postgres database and checks new passwords against them:

password_policy_history.max_password_history = 5
password_policy_history.max_number_accounts = 100

Caveats

• Version 2.0.5 supports PostgreSQL 14-18.
• This module must be preloaded; changing shared_preload_libraries requires a restart.
• PostgreSQL cannot truly block authentication before it happens, so soft-lock simulates the lock by delaying and returning an error. It does not mitigate authentication DoS attacks.
• Size password_policy_lock.max_number_accounts and password_policy_history.max_number_accounts realistically to avoid wasted memory or missed accounts.