CREATE/ALTER SUBSCRIPTION statements is automatically masked as ******** in logs and other places, preventing plaintext passwords from being written to logs.PostgreSQL Version | Supported Version |
PostgreSQL 10 | v10.17_r1.7 or later |
PostgreSQL 11 | v11.12_r1.6 or later |
PostgreSQL 12 | v12.7_r1.7 or later |
PostgreSQL 13 | v13.20_r1.23 or later |
PostgreSQL 14 | v14.17_r1.31 or later |
PostgreSQL 15 | v15.12_r1.17 or later |
PostgreSQL 16 | v16.8_r1.11 or later |
PostgreSQL 17 | v17.4_r1.5 or later |
PostgreSQL 18 | v18.0_r1.0 or later |
SHOW tencentdb_version;.shared_preload_libraries parameter on the parameter settings page in the console, select tencentdb_pwdcheck in its running value, save the changes, and restart the instance.tencentdb_pwdcheck.enable_tencentdb_pwdcheck parameter on the parameter settings page in the console for the password check to take effect. Subscription password masking does not require this switch and takes effect immediately after the plugin is loaded.SIGHUP level and can be modified in the console parameter settings. They take effect automatically after being saved, without requiring an instance restart.Parameter | Default Value | Description |
tencentdb_pwdcheck.enable_tencentdb_pwdcheck | off | Master switch for password check and authentication delay |
tencentdb_pwdcheck.min_length | 8 | Minimum password length |
tencentdb_pwdcheck.max_length | 32 | Maximum password length |
tencentdb_pwdcheck.min_uppercase_number | 1 | Minimum number of uppercase letters |
tencentdb_pwdcheck.min_lowercase_number | 1 | Minimum number of lowercase letters |
tencentdb_pwdcheck.min_digit_number | 1 | Minimum number of digits |
tencentdb_pwdcheck.min_special_character_number | 1 | Minimum number of special characters |
tencentdb_pwdcheck.delay_milliseconds | 0 | Delay in milliseconds upon authentication failure |
()`~!@#$%^&*-+=_|{}[]:;'<>,.?/ (excluding the backslash \\). Other characters in the password, such as spaces or Chinese characters, will be rejected directly.root (a member of tencentdb_superuser), and the business user is app_user.tencentdb_pwdcheck.enable_tencentdb_pwdcheck, change its running value to on, and save the changes.postgres=# SHOW tencentdb_pwdcheck.enable_tencentdb_pwdcheck;tencentdb_pwdcheck.enable_tencentdb_pwdcheck----------------------------------------------on(1 row)
postgres=# CREATE USER app_user PASSWORD 'weak';CREATE ROLE
postgres=# ALTER USER app_user PASSWORD '123';ALTER ROLE
root=> ALTER USER app_user PASSWORD 'asd';ERROR: Password too short. Minimum length is 8.root=> ALTER USER app_user PASSWORD 'abcdsdefg';ERROR: password need at least 1 uppercase letterroot=> ALTER USER app_user PASSWORD 'Aassdsaddb@';ERROR: password need at least 1 digitroot=> ALTER USER app_user PASSWORD 'Aassadasddb11';ERROR: password need at least 1 special characterroot=> ALTER USER app_user PASSWORD 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';ERROR: Password too long. Maximum length is 32.root=> ALTER USER app_user PASSWORD 'md5e589150ae7d28f93333afae92b36ef48';ERROR: Cannot use tencentdb_pwdcheck extension while using encrypted passwordroot=> ALTER USER app_user PASSWORD 'Aassadasddb11#$';ALTER ROLE
tencentdb_pwdcheck.min_length, change its running value to 12, and save the changes.root=> ALTER USER app_user PASSWORD 'AAaa11$$';ERROR: Password too short. Minimum length is 12.root=> ALTER USER app_user PASSWORD 'AAaa11$$abcd';ALTER ROLE
CREATE SUBSCRIPTION statement contains the publisher password. After the plugin is loaded, the password is automatically masked when the statement is displayed in database logs, error details, and other places.postgres=# CREATE SUBSCRIPTION sub_testCONNECTION 'host=127.0.0.1 port=1 dbname=postgres user=replicator password=Secret@123'PUBLICATION pub_test;ERROR: subscription "sub_test" could not connect to the publisher: connection to server at "127.0.0.1", port 1 failed: Connection refusedIs the server running on that host and accepting TCP/IP connections?
pg_log directory). The passwords in the recorded statements have been masked as ********:2026-10-14 16:31:12.816 CST [4151291] LOG: statement: CREATE SUBSCRIPTION sub_testCONNECTION 'user=replicator password=******** dbname=postgres host=127.0.0.1 port=1'PUBLICATION pub_test;
ALTER SUBSCRIPTION statement is also protected by masking.tencentdb_pwdcheck.delay_milliseconds to a value greater than 0 in the console parameter settings, connections with failed password authentication will be delayed to increase the cost of brute-force attacks. In a test with a wrong password and the delay set to 2000 ms, a single failed connection took about 2.010 seconds after the delay took effect, compared with about 0.009 seconds when no delay was set (0 ms). This parameter only affects connections with failed authentication, and normal logins are not affected.shared_preload_libraries has tencentdb_pwdcheck selected and the instance has been restarted, the tencentdb_pwdcheck.enable_tencentdb_pwdcheck parameter is set to on, and the current operating user is not a superuser.Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback