credcheck
credcheck - postgresql plain text credential checker
Overview
| Package | Version | Category | License | Language |
|---|---|---|---|---|
credcheck | 4.6 | SEC | MIT | C |
| ID | Extension | Bin | Lib | Load | Create | Trust | Reloc | Schema |
|---|---|---|---|---|---|---|---|---|
| 7310 | credcheck | No | Yes | Yes | Yes | No | No | - |
| Related | passwordcheck_cracklib login_hook passwordcheck pgaudit pg_auth_mon set_user auth_delay pg_permissions |
|---|
Version
| Type | Repo | Version | PG Ver | Package | Deps |
|---|---|---|---|---|---|
| EXT | PGDG | 4.6 | 1817161514 | credcheck | - |
| RPM | PGDG | 4.6 | 1817161514 | credcheck_$v | - |
| DEB | PGDG | 4.6 | 1817161514 | postgresql-$v-credcheck | - |
Install
You can install credcheck directly. First, make sure the PGDG repository is added and enabled:
pig repo add pgdg -u # Add PGDG repo and update cache
Install the extension using pig or apt/yum/dnf:
pig install credcheck; # Install for current active PG version
pig ext install -y credcheck -v 18 # PG 18
pig ext install -y credcheck -v 17 # PG 17
pig ext install -y credcheck -v 16 # PG 16
pig ext install -y credcheck -v 15 # PG 15
pig ext install -y credcheck -v 14 # PG 14
dnf install -y credcheck_18 # PG 18
dnf install -y credcheck_17 # PG 17
dnf install -y credcheck_16 # PG 16
dnf install -y credcheck_15 # PG 15
dnf install -y credcheck_14 # PG 14
apt install -y postgresql-18-credcheck # PG 18
apt install -y postgresql-17-credcheck # PG 17
apt install -y postgresql-16-credcheck # PG 16
apt install -y postgresql-15-credcheck # PG 15
apt install -y postgresql-14-credcheck # PG 14
Preload:
shared_preload_libraries = 'credcheck';
Create Extension:
CREATE EXTENSION credcheck;
Usage
credcheck: Credential checking for PostgreSQL usernames and passwords
credcheck enforces configurable rules for username and password strength during CREATE ROLE, ALTER ROLE, and password changes. It also supports password reuse policies and authentication failure banning.
Configuration Parameters
Add to postgresql.conf:
shared_preload_libraries = 'credcheck'
Username Checks
| Parameter | Description | Example |
|---|---|---|
credcheck.username_min_length | Minimum username length | 4 |
credcheck.username_min_special | Minimum special characters | 1 |
credcheck.username_min_digit | Minimum digit characters | 1 |
credcheck.username_min_upper | Minimum uppercase characters | 2 |
credcheck.username_min_lower | Minimum lowercase characters | 1 |
credcheck.username_min_repeat | Max adjacent repeat characters | 2 |
credcheck.username_contain | Must contain one of these chars | a,b,c |
credcheck.username_not_contain | Must not contain these chars | x,y,z |
credcheck.username_contain_password | Username must not contain password | on |
Password Checks
| Parameter | Description | Example |
|---|---|---|
credcheck.password_min_length | Minimum password length | 8 |
credcheck.password_min_special | Minimum special characters | 1 |
credcheck.password_min_digit | Minimum digit characters | 1 |
credcheck.password_min_upper | Minimum uppercase characters | 1 |
credcheck.password_min_lower | Minimum lowercase characters | 1 |
credcheck.password_min_repeat | Max adjacent repeat characters | 3 |
credcheck.password_contain_username | Password must not contain username | on |
credcheck.password_valid_until | Minimum days for VALID UNTIL | 60 |
credcheck.password_valid_max | Maximum days for VALID UNTIL | 365 |
credcheck.whitelist | Usernames excluded from checks | admin,super |
Examples
-- Rejected: username too short
CREATE USER abc WITH PASSWORD 'pass';
-- ERROR: username length should match the configured credcheck.username_min_length
-- Rejected: password contains username
CREATE USER abcd$ WITH PASSWORD 'abcd$xyz';
-- ERROR: password should not contain username
Password Reuse Policy
SET credcheck.password_reuse_history = 2;
SET credcheck.password_reuse_interval = 365; -- days
View password history:
SELECT rolename, password_hash FROM pg_password_history;
Authentication Failure Ban
SET credcheck.max_auth_failure = 3; -- ban after 3 failures
Reset banned users:
SELECT pg_banned_role_reset(); -- reset all
SELECT pg_banned_role_reset('username'); -- reset specific user
Feedback
Was this page helpful?
Thanks for the feedback! Please let us know how we can improve.
Sorry to hear that. Please let us know how we can improve.