Detections
Analytics
5.6 Ensure password complexity is configured
Information
Password complexity configuration is crucial to restrict unauthorized access to data. By default, PostgreSQL does not provide for password complexity. Moreover, many compliance frameworks, such as PCI DSS and HIPAA, require both password complexity and length. It is worth stating that the NIST SP 800-63B Digital Identity Guidelines publication is a good reference for authentication management. To implement proper password complexity, it is highly recommended that external authentication be used. See the previous section of this benchmark for more details. The method shown here should only be implemented to the extent that external authentication cannot be used.Having strong password management for your locally-authenticated PostgreSQL accounts will protect against attackers' brute force techniques. This is important especially if external authentication is not possible to implement due to application requirements or restrictions.
Solution
Alter the postgresql.conf configuration file to enable passwordcheck as an extension in the shared_preload_libraries parameter and restart the PostgreSQL service:$ vi ${PGDATA}/postgresql.conf
Find the shared_preload_libraries entry, and add passwordcheck to it (preserving any existing entries):
shared_preload_libraries = '$libdir/passwordcheck'
OR
shared_preload_libraries = 'pgaudit,passwordcheck,<existing entries>'
Restart the PostgreSQL server for changes to take effect:
# whoami
root
# systemctl restart postgresql-17
# systemctl status postgresql-17|grep 'ago$'
Active: active (running) since [date] 10s ago
Impact:
Enabling the passwordcheck module requires a restart of the PostgreSQL service. Passwords are only evaluated when they are set via CREATE ROLE or ALTER ROLE ; existing passwords are not retroactively checked, and passwords submitted to the server in pre-hashed form cannot be evaluated.
See Also
Item Details
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(1), CSCv7|4.4
Plugin: PostgreSQLDB
Control ID: 6d15b0e789bc1ea2aab9862979a16288612c924d52bce92947bfcb8b83597a4f