credcheck

pig repo add pgdg -u          # 添加 PGDG 仓库并更新缓存

shared_preload_libraries = 'credcheck';

CREATE EXTENSION credcheck;

shared_preload_libraries = 'credcheck'

-- 拒绝：用户名太短
CREATE USER abc WITH PASSWORD 'pass';
-- ERROR: username length should match the configured credcheck.username_min_length

-- 拒绝：密码包含用户名
CREATE USER abcd$ WITH PASSWORD 'abcd$xyz';
-- ERROR: password should not contain username

SET credcheck.password_reuse_history = 2;
SET credcheck.password_reuse_interval = 365;  -- 天

SELECT rolename, password_hash FROM pg_password_history;

SET credcheck.max_auth_failure = 3;  -- 3次失败后封禁

SELECT pg_banned_role_reset();              -- 重置所有
SELECT pg_banned_role_reset('username');     -- 重置特定用户