Rejecting weak passwords
in [PgSql]
|
From: Euler Taveira de Oliveira on 1 Oct 2009 13:07 Magnus Hagander escreveu: > On Thu, Oct 1, 2009 at 17:24, Tom Lane <tgl(a)sss.pgh.pa.us> wrote: >> Dave Page <dpage(a)pgadmin.org> writes: >>> How will people know how to use it, or that it's even there without at >>> least a note in the docs somewhere? >> We don't normally document function hooks anywhere but the source code. >> That's one of the things that makes them low overhead ;-) >> >> I agree with the subsequent comments suggesting a sample module that >> actually does something useful --- although if it's going to link to >> external code like cracklib, it probably is going to have to be on >> pgfoundry not in contrib. > > Why is that? we have plenty of other things in contrib that rely on > external code, for example the uuid, xml or ssl stuff. > Because cracklib is GPL'ed. -- Euler Taveira de Oliveira http://www.timbira.com/ -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
From: Magnus Hagander on 1 Oct 2009 13:12 On Thu, Oct 1, 2009 at 19:07, Tom Lane <tgl(a)sss.pgh.pa.us> wrote: > Magnus Hagander <magnus(a)hagander.net> writes: >> On Thu, Oct 1, 2009 at 17:24, Tom Lane <tgl(a)sss.pgh.pa.us> wrote: >>> I agree with the subsequent comments suggesting a sample module that >>> actually does something useful --- although if it's going to link to >>> external code like cracklib, it probably is going to have to be on >>> pgfoundry not in contrib. > >> Why is that? we have plenty of other things in contrib that rely on >> external code, for example the uuid, xml or ssl stuff. > > Well, maybe. I was concerned about availability, portability, license > compatibility, and so on. The bar's a lot lower for pgfoundry projects > on all those points ... Fair enough. And on the licensing issue. That said, it would still be good to have something actually *useful* in contrib. A bit more than just comparing userid and password. Perhaps at least being able to set the min length, and the requirement on having >1 "character class"? -- Magnus Hagander Me: http://www.hagander.net/ Work: http://www.redpill-linpro.com/ -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
From: Kenneth Marshall on 1 Oct 2009 13:19 On Thu, Oct 01, 2009 at 01:07:04PM -0400, Tom Lane wrote: > Magnus Hagander <magnus(a)hagander.net> writes: > > On Thu, Oct 1, 2009 at 17:24, Tom Lane <tgl(a)sss.pgh.pa.us> wrote: > >> I agree with the subsequent comments suggesting a sample module that > >> actually does something useful --- although if it's going to link to > >> external code like cracklib, it probably is going to have to be on > >> pgfoundry not in contrib. > > > Why is that? we have plenty of other things in contrib that rely on > > external code, for example the uuid, xml or ssl stuff. > > Well, maybe. I was concerned about availability, portability, license > compatibility, and so on. The bar's a lot lower for pgfoundry projects > on all those points ... > > regards, tom lane > It has been a while since I last used cracklib, but the interface is generic enough that the sample we would ship in contrib could be trivially adapted to use cracklib. The version we include could just have the (username = password) check or something similar. Regards, Ken -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
From: Andrew Dunstan on 1 Oct 2009 13:34 Tom Lane wrote: > Magnus Hagander <magnus(a)hagander.net> writes: > >> On Thu, Oct 1, 2009 at 17:24, Tom Lane <tgl(a)sss.pgh.pa.us> wrote: >> >>> I agree with the subsequent comments suggesting a sample module that >>> actually does something useful --- although if it's going to link to >>> external code like cracklib, it probably is going to have to be on >>> pgfoundry not in contrib. >>> > > >> Why is that? we have plenty of other things in contrib that rely on >> external code, for example the uuid, xml or ssl stuff. >> > > Well, maybe. I was concerned about availability, portability, license > compatibility, and so on. The bar's a lot lower for pgfoundry projects > on all those points ... > > Yeah. I don't want to add another external dependency if we can avoid it. A module that depends on another library needs configure support etc. Surely we could provide something at least mildly useful without it getting too complex or depending on an external library. Remember, this is an example, not meant to have all the bells and whistles anyone could want. cheers andrew -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
From: Tom Lane on 1 Oct 2009 13:46
Magnus Hagander <magnus(a)hagander.net> writes: > That said, it would still be good to have something actually *useful* > in contrib. A bit more than just comparing userid and password. > Perhaps at least being able to set the min length, and the requirement > on having >1 "character class"? +1. There's still the issue of not being able to do much with a pre-MD5'd password, though. regards, tom lane -- Sent via pgsql-hackers mailing list (pgsql-hackers(a)postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers |