PG密码加强插件之passwordcheck
Tags： passwordcheckPG密码加强密码验证插件
👉 本文共约731个字，系统预计阅读时间或需3分钟。
简介
PostgreSQL自带了一个插件passwordcheck可以满足简单的密码复杂度测验, 防止使用过短, 或者与包含用户名的密码，只需要把“$libdir/passwordcheck”加入到postgresql.conf的shared_preload_libraries参数中，然后重启服务器即可，只要通过CREATE ROLE或ALTER ROLE设置用户，passwordcheck模块就会检查用户的口令。
在该模块中，主要有3个规则判断，一个是用户名自身的判断，是否包含用户名本身；一个是密码长度少于8位的判断；必须包含字母和非字母。
passwordcheck安装
下载PostgreSQL源码，配置passwordcheck
如果当前的PG非源码安装，或者以前编译源码已清理，需要重新下载对应的PG源码版本
本人提供Oracle、MySQL、PG等数据库的培训和考证业务，私聊QQ646634621或微信db_bao，谢谢！
1 2 3 4 5 6 7 8 9 10 11 12 | [root@test src]# wget https://ftp.postgresql.org/pub/source/v10.14/postgresql-10.14.tar.bz2 [root@test src]# tar xjvf postgresql-10.14.tar.bz2 [root@test src]# cd /opt/src/postgresql-10.14/contrib/passwordcheck/ #修改Makefile, 把注释去掉, 并修改字典文件(不要带.pwd后缀). [root@test passwordcheck]# vi Makefile #把下面两行注释去掉 #修改字典文件/usr/lib/cracklib_dict为步骤3生产的字典 PG_CPPFLAGS = -DUSE_CRACKLIB '-DCRACKLIB_DICTPATH="/opt/src/cracklib-dict"' SHLIB_LINK = -lcrack #修改需要的密码最小长度，修改为13 [root@test passwordcheck]# vi passwordcheck.c #define MIN_PWD_LENGTH 13 |
编译passwordcheck
1 2 3 4 5 6 7 8 9 10 11 12 13 14 | #因为这里是重新下载的源码，需要全部重新编译 [root@test passwordcheck]# cd /opt/src/postgresql-10.14 [root@test postgresql-10.14]# ./configure --prefix=/opt/pgsql [root@test postgresql-10.14]# gmake world #如果有以前的编译的源码，可按以下方式编译 [root@test postgresql-10.14]# cd /opt/src/postgresql-10.14/contrib/passwordcheck [root@test passwordcheck]# make clean rm -f passwordcheck.so libpasswordcheck.a libpasswordcheck.pc rm -f passwordcheck.o [root@test passwordcheck]# make gcc -Wall -Wmissing-prototypes -Wpointer-arith -Wdeclaration-after-statement -Wendif-labels -Wmissing-format-attribute -Wformat-security -fno-strict-aliasing -fwrapv -O2 -fPIC -DUSE_CRACKLIB '-DCRACKLIB_DICTPATH="/opt/src/cracklib-dict"' -I. -I. -I../../src/include -D_GNU_SOURCE -c -o passwordcheck.o passwordcheck.c gcc -Wall -Wmissing-prototypes -Wpointer-arith -Wdeclaration-after-statement -Wendif-labels -Wmissing-format-attribute -Wformat-security -fno-strict-aliasing -fwrapv -O2 -fPIC -shared -o passwordcheck.so passwordcheck.o -L../../src/port -L../../src/common -Wl,--as-needed -Wl,-rpath,'/opt/pgsql/lib',--enable-new-dtags -lcrack [root@test passwordcheck]# ls Makefile passwordcheck.c passwordcheck.o passwordcheck.so |
安装passwordcheck
1 2 3 4 | #以前的先做下备份 [root@test passwordcheck]# mv /opt/pg10/lib/postgresql/passwordcheck.so /opt/pg10/lib/postgresql/passwordcheck.so.bak #拷贝重新编译后的SO文件 [root@test passwordcheck]# cp /opt/src/postgresql-10.14/contrib/passwordcheck/passwordcheck.so /opt/pg10/10/lib/postgresql/ |
添加passwordcheck扩展，重启数据库
1 2 3 | [root@test passwordcheck] vi /opt/pg10/data/postgresql.conf shared_preload_libraries = '$libdir/passwordcheck' [root@test passwordcheck] service postgresql-10 restart |
验证：
1 2 3 4 5 6 7 8 9 | #密码少于13位 postgres=# alter role test password '123456789abc'; ERROR: password is too short #密码太简单 postgres=# alter role test password '1111111111abc'; ERROR: password is easily cracked #设置为字典中排除的密码Twsm_20200917 postgres=# alter role test password 'Twsm_20200917'; ERROR: password is easily cracked |
示例
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 | show shared_preload_libraries; alter system set shared_preload_libraries = 'passwordcheck'; pg_ctl restart postgres=# create role test password 'Test#2020'; CREATE ROLE postgres=# alter role test password 'test#2020'; ERROR: password must not contain user name postgres=# alter role test password 'tes12020'; ALTER ROLE postgres=# alter role test password '2020'; ERROR: password is too short postgres=# alter role test password '2020abc'; ERROR: password is too short postgres=# alter role test password '2020abcd'; ALTER ROLE postgres=# alter role test password '12345678'; ERROR: password must contain both letters and nonletters postgres=# alter role test password ''; ERROR: password is too short postgres=# alter role test password 'abcdffgh'; ERROR: password must contain both letters and nonletters |
CrackLib
如果需要实现更复杂的密码检查, 可以让passwordcheck使用CrackLib来检查口令。
安装过程如下：
安装cracklib以及字典
1 | yum install -y cracklib-devel cracklib-dicts cracklib |
检查安装
1 2 3 4 5 6 7 8 9 10 11 12 13 | # rpm -ql cracklib-dicts /usr/lib64/cracklib_dict.hwm /usr/lib64/cracklib_dict.pwd /usr/lib64/cracklib_dict.pwi /usr/sbin/mkdict /usr/sbin/packer /usr/share/cracklib /usr/share/cracklib/cracklib-small.hwm /usr/share/cracklib/cracklib-small.pwd /usr/share/cracklib/cracklib-small.pwi /usr/share/cracklib/pw_dict.hwm /usr/share/cracklib/pw_dict.pwd /usr/share/cracklib/pw_dict.pwi |
如果需要自己配置生成字典，包括此步骤，否则可跳过
1 2 3 4 5 6 7 | [root@test ~]# mkdir /opt/src [root@test ~]# cd /opt/src [root@test src]# wget http://downloads.sourceforge.net/project/cracklib/cracklib-words/2008-05-07/cracklib-words-20080507.gz [root@test src]# gunzip cracklib-words-20080507.gz #可以到cracklib-words-20080507添加需要排除的密码，如不允许使用Twsm_20200917密码 [root@test src]# echo 'Twsm_20200917' >> cracklib-words-20080507 [root@test src]# create-cracklib-dict -o ./cracklib-dict ./cracklib-words-20080507 |
其它
如果觉得上面的配置太复杂，也可以使用passwordcheck+cracklib的结合体扩展
https://github.com/devrimgunduz/passwordcheck_cracklib
参考：
https://www.postgresql.org/docs/10/passwordcheck.html
https://github.com/digoal/blog/blob/master/201410/20141009_01.md
