Re: [GENERAL] Password strength requirements

2006-12-22 Thread Rafal Pietrak
On Fri, 2006-12-22 at 01:20 -0600, Bruno Wolff III wrote: > On Thu, Dec 21, 2006 at 23:43:06 +0100, > Tomasz Ostrowski <[EMAIL PROTECTED]> wrote: > > > > And everything I need would be very simple to do if there was an > > option to disable self-change of passwords for ordinary users. > > That

Re: [GENERAL] Password strength requirements

2006-12-21 Thread Bruno Wolff III
On Thu, Dec 21, 2006 at 23:43:06 +0100, Tomasz Ostrowski <[EMAIL PROTECTED]> wrote: > > And everything I need would be very simple to do if there was an > option to disable self-change of passwords for ordinary users. That seems like a feature not many other people are going to want. You have t

Re: [GENERAL] Password strength requirements

2006-12-21 Thread Tom Lane
Tomasz Ostrowski <[EMAIL PROTECTED]> writes: > And everything I need would be very simple to do if there was an > option to disable self-change of passwords for ordinary users. If you are using PAM authentication, the password recorded by Postgres is irrelevant, so I'm not seeing what the problem

Re: [GENERAL] Password strength requirements

2006-12-21 Thread Tomasz Ostrowski
On Thu, 21 Dec 2006, Bruno Wolff III wrote: > > But I need an ability to change passwords. > > But do you have to use the native passwords in Postgres? If you use > ldap or pam, you could use passwords maintained somewhere else that > had more strict requirements. As I've written earlier I'd hav

Re: [GENERAL] Password strength requirements

2006-12-21 Thread Bruno Wolff III
On Thu, Dec 21, 2006 at 21:04:33 +0100, Tomasz Ostrowski <[EMAIL PROTECTED]> wrote: > > But I need an ability to change passwords. The easiest way to do it But do you have to use the native passwords in Postgres? If you use ldap or pam, you could use passwords maintained somewhere else that had

Re: [GENERAL] Password strength requirements

2006-12-21 Thread Tomasz Ostrowski
On Thu, 21 Dec 2006, Steve Atkins wrote: > >Is there any way to disallow self changing of password by ordinary > >users? Or force password strength in any other way? > > If you check > http://www.postgresql.org/docs/8.2/static/client-authentication.html > you'll see a bunch of different ways to

Re: [GENERAL] Password strength requirements

2006-12-21 Thread Steve Atkins
On Dec 21, 2006, at 7:08 AM, Tomasz Ostrowski wrote: I'm working on a project which needs to satisfy some legal requirements for password strength. But any postgresql user can do; alter role [session_user] password 'foo'; Is there any way to disallow self changing of password by ordina