passwordcheck_cracklib

Overview

Preload-only; requires cracklib dictionaries.

Version

Build

You can build the RPM / DEB packages for passwordcheck_cracklib using pig build:

pig build pkg passwordcheck_cracklib         # build RPM / DEB packages

Install

You can install passwordcheck_cracklib directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install passwordcheck_cracklib;          # Install for current active PG version

pig ext install -y passwordcheck_cracklib -v 18  # PG 18
pig ext install -y passwordcheck_cracklib -v 17  # PG 17
pig ext install -y passwordcheck_cracklib -v 16  # PG 16
pig ext install -y passwordcheck_cracklib -v 15  # PG 15
pig ext install -y passwordcheck_cracklib -v 14  # PG 14

dnf install -y passwordcheck_cracklib_18       # PG 18
dnf install -y passwordcheck_cracklib_17       # PG 17
dnf install -y passwordcheck_cracklib_16       # PG 16
dnf install -y passwordcheck_cracklib_15       # PG 15
dnf install -y passwordcheck_cracklib_14       # PG 14

apt install -y postgresql-18-passwordcheck-cracklib   # PG 18
apt install -y postgresql-17-passwordcheck-cracklib   # PG 17
apt install -y postgresql-16-passwordcheck-cracklib   # PG 16
apt install -y postgresql-15-passwordcheck-cracklib   # PG 15
apt install -y postgresql-14-passwordcheck-cracklib   # PG 14

Preload:

shared_preload_libraries = '$libdir/passwordcheck_cracklib';

Usage

Sources:

• 3.2.1 README
• 3.2.1 password hook
• PostgreSQL passwordcheck manual

passwordcheck_cracklib checks passwords supplied through CREATE ROLE and ALTER ROLE with CrackLib. It is a server hook library, with no SQL extension objects.

Enable the Hook

Add it to the existing preload list and restart PostgreSQL:

shared_preload_libraries = '$libdir/passwordcheck_cracklib'

Do not run CREATE EXTENSION passwordcheck_cracklib. CrackLib’s library and dictionary must be available to the PostgreSQL operating-system account.

Password Checks

CREATE ROLE app_user LOGIN PASSWORD 'password123';

Weak plaintext passwords cause an error. The hook checks length, the relationship to the username, character composition, and the CrackLib dictionary. A password passing those checks is not a guarantee of resistance to every attack.

Security Boundary

Dictionary checks require the plaintext password at password-change time. When a client supplies an already hashed password, the module cannot perform full strength checks; its remaining check is whether the password equals the username. Enforce the intended password-change path and protect the connection carrying plaintext passwords.

Existing passwords are not scanned retroactively. The hook also chains to a previously installed password-check hook; review other credential-policy libraries before loading them together.