F.24. passwordcheck

|  F.24. passwordcheck   |                  |                                       |                  |                           |
|:----------------------:|------------------|---------------------------------------|------------------|---------------------------|
|[Prev](pageinspect.html)|[Up](contrib.html)|Appendix F. Additional Supplied Modules|[Home](index.html)| [Next](pgbuffercache.html)|

---

## F.24. passwordcheck

[]()

 The `passwordcheck` module checks users' passwords whenever they are set with [CREATE ROLE](sql-createrole.html) or [ALTER ROLE](sql-alterrole.html). If a password is considered too weak, it will be rejected and the command will terminate with an error.

 To enable this module, add `'$libdir/passwordcheck'` to [shared\_preload\_libraries](runtime-config-client.html#GUC-SHARED-PRELOAD-LIBRARIES) in `postgresql.conf`, then restart the server.

 You can adapt this module to your needs by changing the source code. For example, you can use [CrackLib](https://github.com/cracklib/cracklib) to check passwords — this only requires uncommenting two lines in the `Makefile` and rebuilding the module. (We cannot include CrackLib by default for license reasons.) Without CrackLib, the module enforces a few simple rules for password strength, which you can modify or extend as you see fit.

### Caution

 To prevent unencrypted passwords from being sent across the network, written to the server log or otherwise stolen by a database administrator, PostgreSQL allows the user to supply pre-encrypted passwords. Many client programs make use of this functionality and encrypt the password before sending it to the server.

 This limits the usefulness of the `passwordcheck` module, because in that case it can only try to guess the password. For this reason, `passwordcheck` is not recommended if your security requirements are high. It is more secure to use an external authentication method such as GSSAPI (see [Chapter 21](client-authentication.html)) than to rely on passwords within the database.

 Alternatively, you could modify `passwordcheck` to reject pre-encrypted passwords, but forcing users to set their passwords in clear text carries its own security risks.

---

|[Prev](pageinspect.html)|[Up](contrib.html)| [Next](pgbuffercache.html)|
|:-----------------------|:----------------:|--------------------------:|
|   F.23. pageinspect    |[Home](index.html)|   F.25. pg\_buffercache   |

 // \<![CDATA[ \<-- For SVG support if ('WebSocket' in window) { (function() { function refreshCSS() { var sheets = [].slice.call(document.getElementsByTagName("link")); var head = document.getElementsByTagName("head")[0]; for (var i = 0; i \< sheets.length; ++i) { var elem = sheets[i]; head.removeChild(elem); var rel = elem.rel; if (elem.href && typeof rel != "string" || rel.length == 0 || rel.toLowerCase() == "stylesheet") { var url = elem.href.replace(/(&|\\?)\_cacheOverride=\\d+/, ''); elem.href = url + (url.indexOf('?') \>= 0 ? '&' : '?') + '\_cacheOverride=' + (new Date().valueOf()); } head.appendChild(elem); } } var protocol = window.location.protocol === 'http:' ? 'ws://' : 'wss://'; var address = protocol + window.location.host + window.location.pathname + '/ws'; var socket = new WebSocket(address); socket.onmessage = function(msg) { if (msg.data == 'reload') window.location.reload(); else if (msg.data == 'refreshcss') refreshCSS(); }; console.log('Live reload enabled.'); })(); } // ]]\>