Rejecting weak passwords
in [PgSql]
|
From: Aidan Van Dyk on 1 Oct 2009 10:08 * Albe Laurenz <laurenz.albe(a)wien.gv.at> [091001 08:54]: > In the discussion following > http://archives.postgresql.org/pgsql-hackers/2009-09/msg01766.php > the consensus was that a hook that allows you to implement > a password checking routine as a module "would not hurt". > > So here's the patch. > I don't think there is documentation required; > correct me if I am wrong. Can we have the check password hook function called in both the plaintext/encrypted case, with a flag as to whether it's encrypted or not? a. -- Aidan Van Dyk Create like a god, aidan(a)highrise.ca command like a king, http://www.highrise.ca/ work like a slave.
From: "Albe Laurenz" on 1 Oct 2009 11:07 Aidan Van Dyk wrote: > Can we have the check password hook function called in both the > plaintext/encrypted case, with a flag as to whether it's encrypted or > not? It will be called in both cases, and I figured that you can check yourself the same way that PostgreSQL does: If isMD5(password), then it is treated as an encrypted password. Yours, Laurenz Albe -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
From: Tom Lane on 1 Oct 2009 11:24 Dave Page <dpage(a)pgadmin.org> writes: > How will people know how to use it, or that it's even there without at > least a note in the docs somewhere? We don't normally document function hooks anywhere but the source code. That's one of the things that makes them low overhead ;-) I agree with the subsequent comments suggesting a sample module that actually does something useful --- although if it's going to link to external code like cracklib, it probably is going to have to be on pgfoundry not in contrib. regards, tom lane -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
From: Magnus Hagander on 1 Oct 2009 12:56 On Thu, Oct 1, 2009 at 17:24, Tom Lane <tgl(a)sss.pgh.pa.us> wrote: > Dave Page <dpage(a)pgadmin.org> writes: >> How will people know how to use it, or that it's even there without at >> least a note in the docs somewhere? > > We don't normally document function hooks anywhere but the source code. > That's one of the things that makes them low overhead ;-) > > I agree with the subsequent comments suggesting a sample module that > actually does something useful --- although if it's going to link to > external code like cracklib, it probably is going to have to be on > pgfoundry not in contrib. Why is that? we have plenty of other things in contrib that rely on external code, for example the uuid, xml or ssl stuff. -- Magnus Hagander Me: http://www.hagander.net/ Work: http://www.redpill-linpro.com/ -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
From: Tom Lane on 1 Oct 2009 13:07
Magnus Hagander <magnus(a)hagander.net> writes: > On Thu, Oct 1, 2009 at 17:24, Tom Lane <tgl(a)sss.pgh.pa.us> wrote: >> I agree with the subsequent comments suggesting a sample module that >> actually does something useful --- although if it's going to link to >> external code like cracklib, it probably is going to have to be on >> pgfoundry not in contrib. > Why is that? we have plenty of other things in contrib that rely on > external code, for example the uuid, xml or ssl stuff. Well, maybe. I was concerned about availability, portability, license compatibility, and so on. The bar's a lot lower for pgfoundry projects on all those points ... regards, tom lane -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers |