PostgreSQL
TMA-POSTGRES-5.6
Ensure Password Complexity is configured
MediumLevel 1Manual reviewpostgres
Description
Password complexity configuration is crucial to restrict unauthorized access to data. By default, PostgreSQL doesn't provide for password complexity. Moreover, many compliance frameworks such as PCI DSS, and HIPPA require both password complexity and length.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Run SHOW shared_preload_libraries; and SHOW dynamic_library_path; If $libdir/passwordcheck (or passwordcheck when dynamic_library_path is $libdir) is not listed in shared_preload_libraries, this is a failure.
How it is fixed
Fix method: Guidance or infrastructure patch
Add '$libdir/passwordcheck' to shared_preload_libraries in postgresql.conf (keep existing entries), optionally set passwordcheck.min_password_length, and restart PostgreSQL.
Properties
- Operating systems
- Any
- Tags
- postgresdatabaseauthenticationpasswordmanual
- Reference
- CIS PostgreSQL 18 Benchmark v1.0.0 - 5.6 Ensure Password Complexity is configured