passwordcheck

passwordcheck : checks user passwords and reject weak password

Overview

Packages

Install

Config this extension to shared_preload_libraries:

shared_preload_libraries = '$libdir/passwordcheck';

This extension does not need CREATE EXTENSION DDL command

Usage

passwordcheck: Check password strength on CREATE/ALTER ROLE

passwordcheck validates password strength whenever passwords are set using CREATE ROLE or ALTER ROLE. Weak passwords are rejected with an error.

Configuration

Add to postgresql.conf:

shared_preload_libraries = 'passwordcheck'

Configuration Parameters

How It Works

The module checks passwords set via CREATE ROLE or ALTER ROLE:

-- Rejected if password is too short or too weak
CREATE ROLE myuser WITH LOGIN PASSWORD 'abc';
-- ERROR: password is too short

-- Accepted with a strong enough password
CREATE ROLE myuser WITH LOGIN PASSWORD 'Str0ng_P@ssword!';

Default Checks

Without CrackLib, the module enforces:

• Minimum password length (configurable via passwordcheck.min_password_length)
• Password must not be the username
• Basic complexity requirements

Limitations

• Pre-encrypted passwords sent by client programs cannot be fully validated
• The module can only guess the actual password from encrypted submissions
• For stronger security, consider external authentication methods (e.g., GSSAPI)
• No CREATE EXTENSION is required – this is a shared library module only