passwordcheck_cracklib

Overview

Version

Build

You can build the DEB packages for passwordcheck_cracklib using pig build:

pig build pkg passwordcheck_cracklib         # build DEB packages

Install

You can install passwordcheck_cracklib directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

pig install passwordcheck_cracklib;          # Install for current active PG version

pig ext install -y passwordcheck_cracklib -v 18  # PG 18
pig ext install -y passwordcheck_cracklib -v 17  # PG 17
pig ext install -y passwordcheck_cracklib -v 16  # PG 16
pig ext install -y passwordcheck_cracklib -v 15  # PG 15
pig ext install -y passwordcheck_cracklib -v 14  # PG 14

dnf install -y passwordcheck_cracklib_18       # PG 18
dnf install -y passwordcheck_cracklib_17       # PG 17
dnf install -y passwordcheck_cracklib_16       # PG 16
dnf install -y passwordcheck_cracklib_15       # PG 15
dnf install -y passwordcheck_cracklib_14       # PG 14

apt install -y postgresql-18-passwordcheck-cracklib   # PG 18
apt install -y postgresql-17-passwordcheck-cracklib   # PG 17
apt install -y postgresql-16-passwordcheck-cracklib   # PG 16
apt install -y postgresql-15-passwordcheck-cracklib   # PG 15
apt install -y postgresql-14-passwordcheck-cracklib   # PG 14

Preload:

shared_preload_libraries = '$libdir/passwordcheck_cracklib';

Usage

passwordcheck_cracklib: Strengthen PostgreSQL user password checks with cracklib

passwordcheck_cracklib is like the regular PostgreSQL passwordcheck module, except it is built with cracklib for more strict password checks. It checks users’ passwords whenever they are set with CREATE ROLE or ALTER ROLE. If a password is considered too weak, it will be rejected and the command will terminate with an error.

Configuration

Add the library to shared_preload_libraries in postgresql.conf:

shared_preload_libraries = '$libdir/passwordcheck_cracklib'

Restart PostgreSQL to activate.

How It Works

Once loaded, any CREATE ROLE or ALTER ROLE command that sets a password will have the password checked against cracklib’s dictionary. Weak or easily guessable passwords will be rejected automatically.

-- This will be rejected if the password is too weak
CREATE ROLE myuser WITH LOGIN PASSWORD 'password123';
-- ERROR: password is easily cracked

-- A strong password will be accepted
CREATE ROLE myuser WITH LOGIN PASSWORD 'X9#kLm$vQ2!pR7';

No CREATE EXTENSION is required – this is a shared library module only.